fix(ci): support ipset sockets and deployed image smoke checks

scripts/ci/linux-agent-container-smoke.sh

@@ -22,13 +22,15 @@ docker build --file scripts/ci/linux-agent-smoke.Dockerfile --iidfile "$tmp/imag
 image="$(cat "$tmp/image-id")"
 printf '%s\n' "$image" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo 'Missing immutable helper image ID' >&2; exit 1; }
 set -- docker run --rm --name "$name" --network none \
-  --cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN \
+  --cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN --cap-add NET_RAW \
   --security-opt no-new-privileges:true \
   --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m \
   --pids-limit 256 --cpus 2 --memory 512m
 # docker-default AppArmor denies the mount operations used by unshare/ip-netns.
 # Only this disposable, networkless helper gets the mount-capable exception.
-# Default seccomp remains enabled and adapts to the two granted capabilities.
+# libxt_set opens an AF_INET/SOCK_RAW/IPPROTO_RAW socket to query ipset;
+# NET_RAW permits that query inside the isolated helper network namespace.
+# Default seccomp remains enabled and adapts to the granted capabilities.
 security="$(docker info --format '{{json .SecurityOptions}}')"
 if printf '%s' "$security" | grep -q apparmor; then
   set -- "$@" --security-opt apparmor=unconfined