fix(envd): log net.Connections error in port scanner and add unit tests

[chill-czar]

Closes #3421

Summary

• Add logger *zerolog.Logger field to Scanner and log net.Connections("tcp") errors in packages/envd/internal/port/scan.go
• Prevent ScanAndBroadcast from signaling subscribers with nil connection lists on scan failure
• Update NewScanner in packages/envd/main.go to receive logger
• Bump envd version to 0.6.14 in packages/envd/pkg/version.go
• Add unit test coverage in packages/envd/internal/port/scan_test.go for scanner initialization, filtering, and prompt shutdown

Why

Currently, ScanAndBroadcast discards errors returned by net.Connections("tcp") with _. When reading /proc/net/tcp fails (e.g. transient procfs read failures or system resource exhaustion), processes is nil. ScanAndBroadcast passes nil to subscribers, causing Forwarder to assume zero TCP ports are open. As a result, Forwarder marks all active forwarded ports as DELETE and forcibly kills all active background socat forwarding processes, silently dropping user process reachability inside sandboxes. Logging the error and skipping subscriber signaling on failure preserves active socat port forwarding until the next successful scan.

Test Plan

• Unit tests pass: go test -count=1 -v ./packages/envd/internal/port/...
• Code inspection & validation: go vet ./packages/envd/internal/port/... ./packages/envd/...
• Verified scanner lifecycle, subscriber filtering, and prompt shutdown via Destroy() in scan_test.go
• Bumped envd version to 0.6.14 per docs/ARCHITECTURE.md requirement

/cc @jakubno @dobrac @ValentaTomas @arkamar @tvi

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 400e5fedb0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Bump envd version for the scanner behavior change

This changes envd port-forwarding behavior: when net.Connections("tcp") fails, the forwarder now preserves the previous port set instead of treating the scan as empty. packages/envd/pkg/version.go is unchanged from the parent (0.6.13), so template builds containing this fix record the same envd version as builds without it; because the API/orchestrator gate behavior on the recorded envd version, rollouts cannot distinguish sandboxes with the new scanner semantics. Please bump the envd version with this behavioral change.

Useful? React with 👍 / 👎.

[chill-czar]

Bumped envd version to 0.6.14 in packages/envd/pkg/version.go for the scanner behavioral change over upstream/main (0.6.13).

[chill-czar]

Hi @jakubno @ben-fornefeld, whenever you get a chance, could you please take a look at this PR?

Quick summary: This fix prevents envd's port scanner from silently dropping active socat forwarded ports when net.Connections("tcp") fails (e.g. transient procfs read issues). We've logged errors, preserved existing ports on scan failure, bumped envd version to 0.6.14, and added unit tests in scan_test.go. All tests are passing. Thanks!