setup: keep guest hostname resolvable

[DarkaMaul]

patch_guest_network writes /etc/hostname as claude-<instance> but leaves
/etc/hosts untouched, so the guest's own hostname has no resolver entry. On
the Firecracker rootfs that makes sudo print
unable to resolve host claude-<instance> ahead of every guest command that
invokes it.

This patches /etc/hosts alongside the existing hostname write, on the same
loop mount, so it covers both create_instance and restore_instance_rootfs.
The two writes move into patch_guest_identity; the line transform is a pure
helper, hosts_with_hostname.

The 127.0.1.1 line is replaced whole. An alias on that line named the
previous hostname (the template's claude-vm), so preserving it would keep a
stale name resolvable. The read-modify-write is kept — rather than writing a
deterministic hosts file — because it preserves entries elsewhere in the
file that coop did not author. Duplicate 127.0.1.1 lines collapse to one, so
the transform is idempotent.

The read is bounded and best-effort. coop commit snapshots a
guest-mutated rootfs into an image template, so /etc/hosts can come back
missing, oversized or non-UTF-8. An earlier draft propagated that with ?,
which would have turned a cosmetic fix into a failed coop up --image /
coop restore on a rootfs that used to boot fine. read_guest_hosts reads one
byte past a 64 KiB cap via head -c (so an oversized file is detected rather
than written back truncated) and degrades to a synthesized default.

chmod 644 follows the write. tee keeps an existing file's mode but
creates a new one under the root session's umask, which comes from the host's
PAM/login.defs; under the CIS baseline's UMASK 027 a freshly created
/etc/hosts would land unreadable to the resolver it exists for — the trap
vm.rs's PID_TRAMPOLINE fixed for the PID file.

The guest hostname is clamped to 63 bytes, one under Linux's
HOST_NAME_MAX of 64. Instance names allow 64 characters and the hostname is
claude- + name, so 71 was reachable. An over-long name cannot reach the
running hostname intact, so /etc/hostname and the /etc/hosts alias would
name different things — and the warning would stay. Deriving both from one
value keeps them equal. Names up to 56 characters are unaffected.

Migration

No image rebuild is needed: the patch is per-instance and the image's own
claude-vm entry is what gets overwritten. But patch_guest_network runs only
at create and restore — start_existing does not re-patch — so an instance
created before this lands keeps the stale entry until
coop restore <vm> --image <image> or a destroy and recreate.

Testing

• cargo fmt -- --check, cargo clippy --all-targets --all-features -D warnings,
  cargo test (1123 lib tests + doctests), prek run — all clean on macOS.
• 13 unit tests on the pure helpers: replace, append, whole-line replacement,
  duplicate collapsing, missing trailing newline, blank-input default, comment
  and blank-line preservation, idempotency, the hostname clamp and its
  exact-fit boundary, and the read bound at-cap / over-cap / on-error.
• tests/integration.sh test_sudo gains the assertion only that layer can
  make: the guest resolves its own name (getent hosts $(hostname)) and
  sudo -n true prints no resolver warning. It is gated to the Firecracker
  leg and skips on Lima, which owns its own guest hostname configuration.
• The integration suite has not been run on either backend, so the
  guest-visible outcome remains reasoned from the code rather than observed.
  CI's check job runs only the host-side integration steps (coop update,
  coop uninstall) and never boots a VM, so it does not cover the new
  assertion either.

Known limits

• src/setup.rs is whole-module excluded from cargo-mutants
  (.cargo/mutants.toml), so the unit tests are the only guard on the pure
  helpers here; exclude_globs has no per-function re-include.
• The rootfs is loop-mounted rather than chrooted, so a guest-planted symlink
  at /etc/hosts (or a symlinked /etc) is followed by the root-level read,
  write and chmod, and a FIFO there blocks the read with no timeout. The
  escape shape predates this PR — the /etc/hostname and network-config writes
  in the same function have it too, and verify_chroot_binaries documents the
  same resolution semantics — but this PR adds instances of it and the chmod
  is a new primitive. Deliberately not fixed here; noted in
  docs/trust-model.md as unvalidated.

Closeout review

Seven review lenses ran over the branch. Findings fixed in 46bc90f: a false
HOST_NAME_MAX derivation in a comment and in the CHANGELOG; an unverifiable
systemd claim; a dead char-boundary walk (deleted by taking &InstanceName,
whose construction already proves the input ASCII); a tautological clamp test
that compared its output against the constant that produced it; and the 64 KiB
read bound, which had no test at all. Both surviving mutants — clamp 63→70, and
the bound disabled — now fail. The integration block also stopped under-
reporting its skips, and its hostname assertion now checks the answer came from
127.0.1.1 rather than from DNS.

[hbrodin]

Please confine the hosts-file operations to the mounted rootfs before writing or changing permissions. A guest can commit /etc/hosts as an absolute symlink to a host file; the new head → tee → chmod sequence follows it under host root. In a temporary reproduction, the target retained its secret contents while its mode changed from 0600 to 0644. This adds a disclosure capability beyond the existing hostname/network writes. Use descriptor-relative access and replacement, without checking a path and then reopening it.

[hbrodin]

Please reject special files safely before reading. A guest can commit /etc/hosts as a FIFO, and head -c then blocks indefinitely waiting for a writer. The byte cap does not bound waiting, and Cmd::capture has no timeout, so create/restore hangs before the fallback runs. Reproduced with a temporary FIFO. Check the opened descriptor's file type using an approach that cannot block on the initial open.

[hbrodin]

Thanks for your contributions and for documenting the trade-offs and validation gaps clearly. I left two inline findings: a host-file disclosure through symlinks and a FIFO that hangs create/restore.

All eight review lenses ran; no separate diff-noise findings. The 14 extracted helper tests passed and five targeted mutations were caught. Firecracker and Lima integration remain unverified; the green CI jobs do not boot a VM.