chore: de-flake testing

[sjmiller609]

Note

Medium Risk
Medium risk because it changes instance API serialization for the network field and alters when orphaned TAP devices are cleaned up, which can affect runtime networking behavior. CI changes are low risk but may fail builds if the sudo PATH/toolchain differs on runners.

Overview
CI: Adds a Linux workflow step to verify mkfs.erofs, mkfs.ext4, and iptables are available under sudo PATH before tests run, aiming to catch runner misconfiguration early.

Runtime: Updates instanceToOAPI to populate oapi.Instance.Network via JSON marshal/unmarshal (avoiding tight compile-time coupling to generated OpenAPI structs), and makes CleanupOrphanedTAPs skip cleanup when the running instance list is empty (not just nil) to avoid deleting TAPs from concurrent processes/tests.

^{Written by Cursor Bugbot for commit f3b95a1. This will update automatically on new commits. Configure here.}

[sjmiller609]

taking liberty to merge

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Empty slice now skips TAP cleanup breaking production intent

High Severity

Changing the guard from runningInstanceIDs == nil to len(runningInstanceIDs) == 0 breaks the production caller in cmd/api/main.go, which explicitly initializes preserveTAPs to []string{} (not nil) when there are no running VMs, with a comment stating "Initialize to empty slice (not nil) so cleanup runs even with no running VMs." The caller relies on the nil vs empty-slice distinction to differentiate "we don't know what's running, skip cleanup" from "nothing is running, clean up all orphaned TAPs." Now both cases skip cleanup, causing orphaned TAP devices to accumulate indefinitely.

 

[cursor]

Risk assessment: Medium (review required).

Evidence from the code diff:

• cmd/api/api/instances.go: instance network mapping changed from direct struct assignment to map[string]any + json.Marshal/json.Unmarshal into oapiInst.Network, introducing behavioral/API-shape risk and a silent failure path if unmarshal fails.
• lib/network/bridge_linux.go: TAP cleanup semantics changed from nil-only guard to len(...) == 0, which changes cleanup behavior when the running-instance list is empty.
• .github/workflows/test.yml: CI/toolchain verification updates (lower runtime risk, but still part of overall change set).

Decision:

• Not approving in this run because risk is Medium and production codepaths are modified.
• Reviewer requests placed for @hiroTamada and @rgarcia.

---