fix(260513-kru): 增强 GetContainerNetNS 健壮性，修复 worker netns 获取失败

- namespace.go: GetContainerNetNS 增加 5 次重试（每次 300ms），
  重试前验证容器 Running 状态，最终失败时嵌入容器 Status/ExitCode
- container_proxy_provider.go: configureWorkerEgress 后加 500ms sleep，
  给 Docker 时间稳定容器进程状态

Author: ZaneL1u

internal/network/container_proxy_provider.go

@@ -105,6 +105,8 @@ func (p *ContainerProxyProvider) PrepareHost(ctx context.Context, spec HostNetwo
 		return fmt.Errorf("gateway: configure worker routes/DNS: %w", err)
 	}
 
+	time.Sleep(500 * time.Millisecond)
+
 	if err := applyWorkerFirewall(ctx, workerName, gwIP, bridgeGW); err != nil {
 		p.teardownGateway(ctx, hostID)
 		return fmt.Errorf("gateway: apply worker firewall: %w", err)

internal/network/namespace.go

@@ -10,6 +10,7 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/vishvananda/netlink"
 	"github.com/vishvananda/netns"
@@ -40,15 +41,39 @@ func GetContainerNetNS(containerName string) (netns.NsHandle, uint32, error) {
 		}
 	}
 
-	ns, err := netns.GetFromPid(int(pid))
-	if err != nil {
-		return 0, 0, &NetworkError{
-			Type:    ErrTunnelSetupFailed,
-			Message: fmt.Sprintf("get netns from pid %d: %v", pid, err),
+	const maxRetry = 5
+	var lastErr error
+	for attempt := 1; attempt <= maxRetry; attempt++ {
+		// 每次重试前验证容器是否仍在运行
+		runningOut, runErr := exec.Command("docker", "inspect", "-f", "{{.State.Running}}", containerName).Output()
+		if runErr != nil || strings.TrimSpace(string(runningOut)) != "true" {
+			if attempt < maxRetry {
+				time.Sleep(300 * time.Millisecond)
+				continue
+			}
+		}
+
+		ns, nsErr := netns.GetFromPid(int(pid))
+		if nsErr == nil {
+			return ns, uint32(pid), nil
 		}
+		lastErr = nsErr
+		if attempt < maxRetry {
+			time.Sleep(300 * time.Millisecond)
+		}
+	}
+
+	// 最后一次失败时，获取容器状态信息嵌入错误
+	statusOut, _ := exec.Command("docker", "inspect", "-f", "{{.State.Status}}|{{.State.ExitCode}}", containerName).Output()
+	statusInfo := strings.TrimSpace(string(statusOut))
+	if statusInfo == "" {
+		statusInfo = "unknown"
 	}
 
-	return ns, uint32(pid), nil
+	return 0, 0, &NetworkError{
+		Type:    ErrTunnelSetupFailed,
+		Message: fmt.Sprintf("get netns from pid %d after %d attempts (container status=%s): %v", pid, maxRetry, statusInfo, lastErr),
+	}
 }
 
 // InjectManagementVeth creates a veth pair between the host and container