feat(runtime): host-side entrypoint log tailer for Cloud Run sandboxes

[ptone]

Summary

Implements the host-side entrypoint log tailer for Cloud Run sandboxes (#112). One goroutine per sandbox tails .scion-entrypoint.log and re-emits each line to the host process stdout as GCP-structured JSON. Cloud Run captures host stdout and forwards it to Cloud Logging automatically. No client library, no service account, no new module dependency.

This makes startup failures visible. It does not make runtime failures visible. Silence from this channel after a successful startup means "init completed and handed off to tmux", not "the agent is healthy."

Key behaviors

• Stat-before-launch offset: captures file size before sandbox creation; skips prior-run content when PR 1323 (append-mode) is present
• Partial final line flush: on any terminal exit of the goroutine, the unterminated buffer is emitted with partial:true. The crash message that names the cause of death is never swallowed
• File-never-created detection: if watchCtx is cancelled and the file was never opened, emits one ERROR with file_never_created:true — the only way to distinguish "died before it could say anything" from "started fine and went quiet"
• Truncation detection: if file size < expected offset (PR 1323 reverted or file replaced), emits WARNING with truncation_detected:true and reads from start — duplicated output with an explanation, not silence
• Buffer cap: 64KB max partial-line buffer; lines exceeding it emit with truncated_line:true
• Backoff: 250ms x10, 1s x10, then 5s; resets to 250ms on new data (including on truncation detection)

PR 1323 interaction

Works with or without PR 1323 (append-mode entrypoint redirect). With it: clean per-run separation. Without it: truncation warning fires and still ships the output. Degradation is visible, not silent.

Design deviations

openWithRetry (F1): the design says persistent non-ENOENT open errors should emit ERROR and exit after the retry schedule is exhausted. This implementation keeps polling with WARNING every 5s instead. Rationale: noisy beats absent. A permission error will complain visibly until the sandbox is torn down (watchCtx cancelled). The error may be transient, and exiting permanently silences the channel on an assumption. watchCtx provides the bounded lifetime regardless. Documented in a comment on openWithRetry.

Test coverage limitation

Exit path 2 (non-EOF read error in the read loop) is defensive code, reachable only through infrastructure-level errors such as EIO from disk corruption. TestTailer_ReadErrorExitPath2 proves the path is reachable using a real EISDIR syscall error and that the goroutine exits cleanly, but does not exercise the flushPartial call at that site. EISDIR fires on the first Read before any bytes enter the line buffer, so flushPartial is called with an empty buffer (a no-op). Getting content into the buffer AND triggering a non-EOF read error on the same fd would require io.Reader injection, which was ruled out as a refactoring change on an already-reviewed read loop. The flushPartial function itself is mutation-tested by TestTailer_FlushPartialUnit.

Rendering note

This PR captures entrypoint log output to Cloud Logging. The captured lines do not yet appear in the operator's /cloud-logs tab — the logquery filter whitelists specific logName values and the tailer's output arrives under Cloud Run's platform stdout logName. Rendering is a separate change to logquery.go and is not in scope for this PR.

Tunable constants (not measured against production)

• 64KB buffer cap: generous; longest plausible line is a debug.Stack() trace (~4-8KB)
• Backoff step counts (10/10): the shape (fast, slow, plateau, reset on data) is load-bearing; counts are arbitrary
• 8s open-retry window: bounded by liveness-probe ladder reasoning (250+500+1000+2000+4000 ms)

Files changed

• pkg/runtime/cloudrun_sandbox_tailer.go — new file: tailEntrypointLog goroutine and helpers
• pkg/runtime/cloudrun_sandbox_tailer_test.go — new file: 14 unit tests against real temp files
• pkg/runtime/cloudrun_sandbox_runtime.go — stat-before-launch (L743-758) and goroutine launch (L885)
• pkg/runtime/cloudrun_sandbox_runtime_test.go — cleanup for watchCtx in existing Run test

Test plan

• Normal append from offset, prior content not re-shipped
• Unterminated final line emitted with partial:true
• Truncation mid-tail: WARNING emitted, reading resumes from 0
• File never created + context cancelled: file_never_created ERROR emitted exactly once
• Context cancellation with partial line pending: partial emitted, clean exit
• Buffer cap exceeded: truncated_line:true, no unbounded growth
• Goroutine exits on cancellation, no leak
• First run (no prior file): offset 0, picks up content when file appears
• Truncation at startup (offset > file size): WARNING + content from start
• Live append: tailer picks up new content as it is written
• JSON format matches GCP structured logging with logging.googleapis.com/labels
• Empty lines skipped
• Exit path 2 reachable via EISDIR: goroutine exits cleanly on real read error
• flushPartial unit test: emits partial:true when buffer non-empty, no-op when empty
• Race detector clean
• gofmt clean
• go vet clean
• Existing package tests all pass