[antithesis] first cut of the Antithesis harness for Nexus and CockroachDB - #11239

…achDB

Adds an antithesis/ directory (Dockerfile, compose topology, configs,
workload crate, test commands, scratchbook) so the simulated control plane
can run under Antithesis, plus the omicron changes that requires:

- an `antithesis` cargo profile and per-binary `antithesis` features that
  link the Antithesis SDK and instrumentation; the SDK compiles to no-ops
  otherwise, and hakari excludes both crates so that stays true.
- a few SDK assertions in Nexus (external API started, CRDB transaction
  retried, saga completed/unwound, saga unwinding never fails).
- standalone sled-agent-sim fixes so it can perform the RSS handoff on
  real (non-loopback) addresses: repo depot no longer binds the sled
  agent's port (omicron#4421), the rack subnet and gz address derive from
  the sled IP, the sled config is ledgered before the handoff as RSS does,
  the initial DNS config carries the internal DNS and Nexus zones, the
  Nexus zone id is configurable so Nexus can find itself in the blueprint,
  an external internal-DNS server can be populated instead of the
  in-process one, CockroachDB nodes can be recorded for from_dns
  discovery, and the request body limit matches the test harness.

Locally the five-container stack reaches setup_complete, `snouty validate`
passes (exactly one copy of each test command, in the workload image), and the seed and
sagas-settle test commands pass. Still blocked on Antithesis: tenant,
credentials (the tenant and repository entries in .snouty.toml), IPv6 network
confirmation.