fix: eliminate host binary dependency in setup-iptables for chroot mode (#456)

* Initial plan

* fix: replace head with awk in setup-iptables for chroot mode

Replace `head -n 1` with awk's NR==1 to avoid GLIBC version mismatch
when running in chroot mode. In chroot mode, host binaries are mounted
at /host/*, and setup-iptables.sh runs before the chroot happens.
The host's head binary may require a newer GLIBC than available in
the container (Ubuntu 22.04 has GLIBC 2.35, GitHub Actions runners
have GLIBC 2.38+).

This fixes the error:
  head: /lib/x86_64-linux-gnu/libc.so.6: version 'GLIBC_2.38' not found

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Author: Copilot

containers/agent/setup-iptables.sh

@@ -36,7 +36,8 @@ SQUID_PORT="${SQUID_PROXY_PORT:-3128}"
 echo "[iptables] Squid proxy: ${SQUID_HOST}:${SQUID_PORT}"
 
 # Resolve Squid hostname to IP
-SQUID_IP=$(getent hosts "$SQUID_HOST" | awk '{ print $1 }' | head -n 1)
+# Use awk's NR to get first line to avoid host binary dependency in chroot mode
+SQUID_IP=$(getent hosts "$SQUID_HOST" | awk 'NR==1 { print $1 }')
 if [ -z "$SQUID_IP" ]; then
   echo "[iptables] ERROR: Could not resolve Squid proxy hostname: $SQUID_HOST"
   exit 1