M2 plumbing: CNI ↔ agent JSON RPC over unix socket

Locks the wire format between /opt/cni/bin/flock and flock-agent. ADD
returns a CNI Result, DEL returns success/error, CHECK returns
success/error. Connection-per-RPC, newline-delimited JSON.

- pkg/cni/rpc.go: shared Op + Request + Response + framed encode/decode.
- pkg/cni/rpc_client.go: net.Dial + EncodeRequest + DecodeResponse;
  rpcSocket overridable for tests.
- pkg/cni/plugin.go: real implementations of CmdAdd/Del/Check that call
  through, mapping agent errors to types.Error.
- pkg/agent/rpc.go: rpcServer with swappable AddHandler/DelHandler/
  CheckHandler (defaults: not-implemented for ADD; idempotent-no-op for
  DEL/CHECK so kubelet teardown of a never-ADDed pod doesn't fail).
- pkg/agent/server.go: replaces the M1 accept-and-close placeholder
  with rpcServer.serve(ctx, listener); listener closes on ctx cancel.

Tests cover: Request/Response JSON roundtrip, end-to-end client →
unix-socket → fake server, agent error → CNI types.Error mapping.

ADD remains "not implemented" until netlink + IPAM wire-up — the agent
returns an error and kubelet will fail pod sandbox creation IF a node
were configured to use this CNI. host001's CNI plane is still 100%
Calico, so this changes nothing observable on the cluster.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/server.go

@@ -18,12 +18,14 @@ import (
 const SocketPath = "/run/flock/flock.sock"
 
 // Server is the agent's runtime container: state store, kubernetes informers,
-// netlink, BIRD, nftables. M1.5 wires the state store, a placeholder unix
-// listener, and a NodeConfig informer.
+// netlink, BIRD, nftables. Current state: state store, NodeConfig informer,
+// RPC dispatcher with stub ADD/DEL/CHECK handlers (will be replaced when
+// netlink + IPAM wire-up lands).
 type Server struct {
 	Node       string
 	Store      *Store
 	NodeConfig *NodeConfigCache
+	RPC        *rpcServer
 	Logger     *slog.Logger
 	socket     string
 	restCfg    *rest.Config
@@ -69,6 +71,7 @@ func NewServer(cfg Config) (*Server, error) {
 		Node:       cfg.Node,
 		Store:      store,
 		NodeConfig: &NodeConfigCache{},
+		RPC:        newRPCServer(cfg.Logger),
 		Logger:     cfg.Logger,
 		socket:     cfg.Socket,
 		restCfg:    restCfg,
@@ -102,16 +105,8 @@ func (s *Server) Run(ctx context.Context) error {
 		"allocations", len(s.Store.Snapshot()),
 	)
 
-	// Accept loop: closes every connection immediately (M2 will dispatch).
-	go func() {
-		for {
-			conn, err := l.Accept()
-			if err != nil {
-				return
-			}
-			_ = conn.Close()
-		}
-	}()
+	// RPC dispatcher takes ownership of the listener.
+	go s.RPC.serve(ctx, l)
 
 	// NodeConfig informer. Any error from the informer terminates Run.
 	errCh := make(chan error, 1)