fix(agent): bundle busybox nsenter — host binary fails to load in distroless

[sarg3nt]

Summary

Follow-up to #144. The resolver change there let stat() find the host's nsenter via /proc/1/root/usr/bin/nsenter, but execve still failed:

pty: start failed: fork/exec /proc/1/root/usr/bin/nsenter:
  no such file or directory

The host's nsenter is dynamically linked. Its PT_INTERP (e.g. /lib64/ld-linux-x86-64.so.2) is resolved by the kernel against the caller's mount namespace, not against PID 1's. Distroless containers have no /lib64 and no glibc, so the ELF loader can't find the interpreter and execve returns ENOENT. The error message is misleading — it refers to the missing interpreter, not the binary itself.

Fix

Bundle a statically-linked nsenter inside the agent image. busybox-musl ships a single static binary that dispatches applets by argv[0]; copying /bin/busybox to /usr/bin/nsenter inside the agent image gives a working nsenter that exec's cleanly in any mount namespace. ~1MB image-size cost; agents not using host-exec mode never run it.

Resolver: container-local paths (/usr/bin/nsenter, …) come first now; /proc/1/root/... paths remain as last-ditch fallback for non-distroless agent flavors that happen to share enough libc layout with the host.

Test plan

• Linux build green
• go test ./... green on agent module
• Redeploy agent on mjolnir; click Mjolnir shell icon — expect session to open and land on TrueNAS host (hostname returns the TrueNAS hostname; pwd shows host directory)
• Container size diff < 2MB

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Follow-up to #144 fixing the distroless agent's host-exec console: the host's dynamically-linked nsenter could be stat()ed through /proc/1/root but failed to execve because its ELF interpreter is invisible in the container's mount namespace. This PR bundles a statically-linked busybox as /usr/bin/nsenter inside the agent image and reorders the resolver to prefer container-local paths.

Changes:

• Add a COPY --from=busybox:1.37.0-musl /bin/busybox /usr/bin/nsenter layer to the agent Dockerfile.
• Reorder nsenterCandidates so container-local /usr/bin, /bin, /usr/sbin, /sbin precede /proc/1/root/... fallbacks.
• Trim /proc/1/root/usr/sbin/nsenter and /proc/1/root/sbin/nsenter from the fallback list and remove the now-redundant in-resolver /usr/bin/nsenter last-ditch check.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
gearbox-agent/internal/api/console/pty/nsenter_linux.go	Reworked candidate list, comments, and resolver to prefer bundled in-container nsenter.
gearbox-agent/Dockerfile	Copies a statically-linked busybox binary into the distroless image as /usr/bin/nsenter.