fix(ci): isolate agent smoke in namespace-capable helper

scripts/ci/linux-agent-container-entry.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+# Fail before any firewall work if the daemon/kernel still forbids namespaces.
+if ! unshare --net --mount --pid --fork --mount-proc true; then
+  echo 'Linux agent helper cannot create required namespaces. A rootful Docker daemon with namespace/netfilter support and the documented helper capabilities is required; smoke was not run.' >&2
+  exit 1
+fi
+python3 -B scripts/ci/linux-agent-fixture.test.py
+export EVOFW_TEST_ETC_DATA=/work/helper-etc
+exec bash scripts/ci/linux-netns-smoke.sh