test(conformance): cover relay reconnect recovery

[elezar]

Summary

Add deterministic conformance coverage for relay attachment recovery across supervisor-session startup and reconnect windows. Carry the focused server fix in this draft so the regression scenario demonstrates both the failure and the intended recovery behavior.

Stack

Main stack: #3641 → #3597 → #3637.

This draft is a side branch from #3597 and should remain draft until the relay fix is accepted independently of the file-transfer migration.

Related Issue

No issue required: this is a localized regression test and fix for the intermittent relay loss originally investigated in #3583 and #3588.

Failure evidence

• Original Docker sync failure
• Docker conformance reproducer
• Rootful Podman conformance reproducer
• Rootless Podman conformance reproducer

Changes

• split sandbox lifecycle coverage into independent state-transition, relay-readiness, and relay-reconnect scenarios
• exercise startup relay readiness in bounded asynchronous pairs
• inject a control-session disconnect for Docker, rootful Podman, and rootless Podman without pausing the workload
• replay pending relay opens when the prior supervisor session was removed before reconnection
• suppress duplicate relay delivery to the same supervisor session
• document reconnect replay behavior

Testing

• mise run pre-commit
• Focused Docker tmachine scenario reproduced relay open timed out before the fix
• Focused rootful Podman scenario reproduced relay open timed out before the fix
• Rootless Podman scenario reproduced relay open timed out before the fix
• Docker, rootful Podman, and rootless Podman conformance suites passed with the fix applied before the rebase
• Post-rebase GitHub E2E checks

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.