[antithesis] first cut of the Antithesis harness for Nexus and CockroachDB

[sunshowers]

From Claude

Adds an antithesis/ directory (Dockerfile, compose topology, configs, workload crate, test commands, scratchbook) so the simulated control plane can run under Antithesis, plus the omicron changes that requires:

• an antithesis cargo profile and per-binary antithesis features that link the Antithesis SDK and instrumentation; the SDK compiles to no-ops otherwise, and hakari excludes both crates so that stays true.
• a few SDK assertions in Nexus (external API started, CRDB transaction retried, saga completed/unwound, saga unwinding never fails).
• standalone sled-agent-sim fixes so it can perform the RSS handoff on real (non-loopback) addresses: repo depot no longer binds the sled agent's port (omicron#4421), the rack subnet and gz address derive from the sled IP, the sled config is ledgered before the handoff as RSS does, the initial DNS config carries the internal DNS and Nexus zones, the Nexus zone id is configurable so Nexus can find itself in the blueprint, an external internal-DNS server can be populated instead of the in-process one, CockroachDB nodes can be recorded for from_dns discovery, and the request body limit matches the test harness.

Locally the five-container stack reaches setup_complete, snouty validate passes (exactly one copy of each test command, in the workload image), and the seed and sagas-settle test commands pass.

TODO:

• break up/deslop