M2: netlink, IPAM/handler wiring, BIRD sidecar, CNI installer

Code (Linux build, with no-op stubs for macOS dev):
- pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode
  none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns →
  configure pod side (addr, default route via fe80::1, v4 169.254.1.1
  on-link gateway) → host /128 + /32 routes. Idempotent.
- pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from
  FNV-1a-32(containerID).
- pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6,
  cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the
  K8S_POD_* keys kubelet sets.
- pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE,
  WaitForPod helper for ADD-vs-informer-sync race.
- pkg/agent/handlers.go: PodHandler does
    cache lookup → annotations → IPAM → store(pending) → SetupFunc →
    store(committed) → Result. Idempotent on retry. Del symmetric.
- pkg/routing/bird/config.go: text/template render with stable ordering;
  golden tests for host001 + anycast injection + sort stability.
- pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms,
  execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole
  kernel routes for the node summary CIDRs so BIRD's protocol kernel
  imports them.
- pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per-
  node NodeConfig, reconciles committed allocations into IPAM.used,
  garbage-collects pending entries, builds PodHandler, swaps RPC
  handlers in.
- cmd/flock-installer: init-container binary that copies /opt/cni/bin/
  flock and writes 01-flock.conflist (lex-first so kubelet picks it
  over Calico's 10-calico.conflist on flock-labeled nodes).

Deploy:
- Dockerfile: alpine + iproute2 + bird2; multi-binary image.
- deploy/daemonset.yaml: install-cni init container; bird sidecar
  sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded
  bootstrap bird.conf so the sidecar boots before the agent renders.
  Privileged on flock-agent + install-cni; bird sidecar uses
  NET_ADMIN/RAW only.
- RBAC: pods + networkpolicies get/list/watch (the latter is reserved
  for M8 — harmless to grant now).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

deploy/install.yaml

@@ -77,7 +77,6 @@ metadata:
   name: flock-agent
   namespace: kube-system
 ---
-# M1.5 RBAC: just enough to read NodeConfig. M2 adds pods + networkpolicies.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -86,6 +85,12 @@ rules:
   - apiGroups: ["flock.fritzlab.net"]
     resources: ["nodeconfigs"]
     verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["networkpolicies"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -100,6 +105,22 @@ subjects:
     name: flock-agent
     namespace: kube-system
 ---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: flock-bird-init
+  namespace: kube-system
+data:
+  bird.conf: |
+    # Bootstrap config served by the bird sidecar until flock-agent
+    # writes the real config. Single-protocol device + kernel keeps BIRD
+    # alive without trying to peer until the agent is ready.
+    log syslog all;
+    router id 127.0.0.1;
+    protocol device { scan time 10; }
+    protocol kernel kernel6 { ipv6 { import all; export all; }; }
+    protocol kernel kernel4 { ipv4 { import all; export all; }; }
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -124,11 +145,8 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       priorityClassName: system-node-critical
-      # M1: opt-in per-node via this label. Remove the nodeSelector when
-      # ready to roll flock to all nodes.
       nodeSelector:
         flock.fritzlab.net/agent: ""
-      # Tolerate the cni-test taint applied during migration.
       tolerations:
         - key: fritzlab.net/cni-test
           operator: Equal
@@ -143,6 +161,37 @@ spec:
         - key: node.kubernetes.io/unreachable
           operator: Exists
           effect: NoExecute
+      initContainers:
+        - name: install-cni
+          image: code.fritzlab.net/fritzlab/flock:latest
+          imagePullPolicy: Always
+          command:
+            - /usr/local/bin/flock-installer
+            - --src=/usr/local/bin/flock
+            - --bin=/host/opt/cni/bin/flock
+            - --conflist=/host/etc/cni/net.d/01-flock.conflist
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: cni-bin
+              mountPath: /host/opt/cni/bin
+            - name: cni-conf
+              mountPath: /host/etc/cni/net.d
+        - name: seed-bird-config
+          image: code.fritzlab.net/fritzlab/flock:latest
+          imagePullPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              mkdir -p /etc/flock/bird
+              if [ ! -s /etc/flock/bird/bird.conf ]; then
+                cp /seed/bird.conf /etc/flock/bird/bird.conf
+              fi
+          volumeMounts:
+            - name: bird-config
+              mountPath: /etc/flock/bird
+            - name: bird-seed
+              mountPath: /seed
       containers:
         - name: flock-agent
           image: code.fritzlab.net/fritzlab/flock:latest
@@ -156,23 +205,37 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          # M1: no privileged caps. M2 adds NET_ADMIN/NET_RAW for netlink.
           securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
+            privileged: true
           volumeMounts:
             - name: lib-flock
               mountPath: /var/lib/flock
             - name: run-flock
               mountPath: /run/flock
+            - name: bird-config
+              mountPath: /etc/flock/bird
+            - name: netns
+              mountPath: /var/run/netns
+              mountPropagation: HostToContainer
           resources:
-            requests:
-              cpu: 25m
-              memory: 32Mi
-            limits:
-              memory: 128Mi
+            requests: { cpu: 25m, memory: 32Mi }
+            limits:   { memory: 256Mi }
+        - name: bird
+          image: code.fritzlab.net/fritzlab/flock:latest
+          imagePullPolicy: Always
+          command: ["bird", "-c", "/etc/flock/bird/bird.conf", "-s", "/run/flock/bird.ctl", "-f"]
+          securityContext:
+            capabilities:
+              add: ["NET_ADMIN", "NET_RAW", "NET_BIND_SERVICE"]
+            allowPrivilegeEscalation: false
+          volumeMounts:
+            - name: bird-config
+              mountPath: /etc/flock/bird
+            - name: run-flock
+              mountPath: /run/flock
+          resources:
+            requests: { cpu: 10m, memory: 16Mi }
+            limits:   { memory: 64Mi }
       volumes:
         - name: lib-flock
           hostPath:
@@ -182,5 +245,24 @@ spec:
           hostPath:
             path: /run/flock
             type: DirectoryOrCreate
+        - name: cni-bin
+          hostPath:
+            path: /opt/cni/bin
+            type: DirectoryOrCreate
+        - name: cni-conf
+          hostPath:
+            path: /etc/cni/net.d
+            type: DirectoryOrCreate
+        - name: netns
+          hostPath:
+            path: /var/run/netns
+            type: DirectoryOrCreate
+        - name: bird-config
+          hostPath:
+            path: /var/lib/flock-bird
+            type: DirectoryOrCreate
+        - name: bird-seed
+          configMap:
+            name: flock-bird-init
       imagePullSecrets:
         - name: code-fritzlab-net