chore: follow up merged PR comments and flake fixes

[sjmiller609]

Summary

Follow-up branch from origin/main to address review feedback from merged PR #136 and keep flake fixes moving on a clean branch.

Review-followup changes

• filter internal boot sentinel noise from app log streaming (HYPEMAN-PROGRAM-START, HYPEMAN-AGENT-READY, HYPEMAN-HEADERS-*) so user-facing app logs are cleaner
• avoid forced boot-marker hydration scans on create/start/restore return path (toInstanceWithoutHydration), removing extra immediate log-scan/write work from the startup hot path
• tighten guest init setup parallelization: run network+volume setup in parallel only when volume mount paths are disjoint from /etc (network writes /etc/resolv.conf)
• clarify StartedAt metadata semantics as boot-epoch start preserved across standby restore
• use Initialize(ctx, nil) for network self-heal preserve-set clarity

Flake fixes carried forward

• wait for Running in cloud-hypervisor running-fork test path
• avoid nil cleanup capture in that test

Validation

• local:
  • go test -tags containers_image_openpgp ./lib/instances -run '^(TestShouldSkipAppLogLine|TestDeriveRunningState|TestHydrateBootMarkersFromLogs_RescanThrottle|TestParseBootMarkers_IgnoresStaleMarkersBeforeBootStart|TestParseBootMarkers_ReturnsLatestMarkerFromNewestLog)$'
• remote (deft-kernel-dev) targeted from branch:
  • go test -count=2 -run '^(TestForkCloudHypervisorFromRunningNetwork|TestCreateInstanceWithNetwork|TestVolumeMultiAttachReadOnly)$' -tags containers_image_openpgp -timeout=50m ./lib/instances

---

Note

Medium Risk
Touches instance lifecycle/state-derivation and guest init ordering; mistakes could change observed instance states/timings or break boot networking/volume mounts. Changes are localized and covered by added unit/integration test adjustments, but affect startup hot paths.

Overview
Reduces instance create/start/restore hot-path work by returning instance state via toInstanceWithoutHydration (and new deriveStateWithoutHydration) to avoid immediate serial-log scans and metadata rewrites for boot-marker hydration.

Cleans up user-facing app log streaming by filtering internal boot sentinel lines (e.g., HYPEMAN-PROGRAM-START, HYPEMAN-AGENT-READY, HYPEMAN-HEADERS-*) and adds tests for the filter.

Hardens runtime flows: fork target-state readiness checks now treat Initializing like Running, the cloud-hypervisor running-fork test waits for Running, guest init now parallelizes network+volume setup only when mounts don’t overlap /etc, and network self-heal calls Initialize(ctx, nil) to clearly skip orphan TAP cleanup.

^{Written by Cursor Bugbot for commit 1646973. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Risk assessment: Medium-High (review required, no self-approval).

Reasoning from code diff:

• Production lifecycle behavior changed across lib/instances (create, start, restore, query) by introducing non-hydrating state derivation on hot paths, which changes when boot-marker scans/persistence happen.
• Guest init sequencing changed in lib/system/init/main.go with conditional parallelization of network + volume setup, affecting boot-time ordering and filesystem/network interaction.
• Network self-heal call semantics changed in lib/network/allocate.go (Initialize(ctx, nil) vs empty slice), which can alter cleanup behavior depending on implementation details.
• User-visible app log stream filtering changed in lib/instances/logs.go.

Validation notes:

• go test ./lib/system/init ./lib/network passed.
• go test ./lib/instances could not run in this environment due missing embedded VM/guest-agent artifacts.

Requested reviewers: @rgarcia, @hiroTamada.

---