R-66: the box's own address becomes visible (v0.159.0)

Leg A: „Hálózat" card on Beállítások → Rendszer — Helyi cím (LAN),
Hálózati név (only while Megosztás is enabled), Átjáró; live per render,
stored nowhere (S-5), „—" on unavailable.
Leg B: network section in the Debug system dump (interfaces/route/DNS/
lan_address), best-effort per item via the samba-netns door.
Leg C: NetBIOS trap named — Szerver field helper text + a purely lexical
hint on unreachable failures for single-label non-IP names.

Design note: all guest-net reads go through docker exec into the
host-networked felhom-samba container (stacks/guestnet.go, one seam) —
the controller's own netns is the docker bridge, so /proc/net/route etc.
would answer 172.x (the S-2 trap). Red-proofs: A2 gate-drop and C2
lexical-invert both failed as required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU

controller/internal/stacks/manager.go

@@ -141,6 +141,10 @@ type Manager struct {
 	// sambaAddrFn replaces the docker-exec that reads the guest's LAN IPv4 out of the samba
 	// container's network namespace (v0.151.0, S-2/S-5 connect-address card).
 	sambaAddrFn func() (string, error)
+	// guestNetExecFn replaces guestnet.go's docker-exec into the samba netns (R-66 gateway row +
+	// Debug dump network section); nil in production. One seam for all guest-net reads — tests
+	// script canned `ip`/resolv.conf outputs per argv and never touch docker.
+	guestNetExecFn func(args ...string) (string, error)
 }
 
 // SetSambaRunProbe injects the samba liveness probe. Exported for the same reason