Transit, host firewalls, and the whole topology raising

The full topology now raises: four machines, three routers, a transit
router, six segments, in 35 seconds. Everything the declaration model can
express except `place`, which is refused because the node host it would
place does not exist yet.

Transit was a real gap, not a bug. The design says public networks are
unrelated and routed to each other, never bridged — and I built the
segments and never built the thing that routes between them, so three
public networks were islands and nothing crossed. A transit router now
holds an interface on every public segment, forwarding and no translation:
the closest thing the lab has to the internet, deliberately dumb.

Proven rather than asserted, by ping TTL across the raised topology:

  within one segment                     ttl=64   no hops
  across two unrelated public networks   ttl=62   gateway + transit
  multicast between public networks      0 replies

A flat internet would have shown ttl=64 and answered multicast — which
would let a node discover a peer it could never reach in production, and
report success. That is the fault the as-is layer records the mesh already
hitting with multicast name resolution.

inbound: deny is implemented as a host firewall on the machine, read back
after applying. A declared refusal that silently did not load leaves the
machine wide open, which looks exactly like a machine that is working.
Established and related traffic is accepted, so a defended machine can
still dial out rather than being a disconnected one.

Verified by running, all of it:

  home -> devices (policy allow)               reachable
  devices -> home (policy deny)                blocked
  behind unforwardable NAT -> out              reachable
  in -> behind unforwardable NAT               unreachable
  inbound: deny, dialling out                  reachable
  reaching a machine that denies inbound       refused

The two routers differ exactly as declared: the forwardable one carries the
policy rule and no inbound drop, the unforwardable one carries `ct state
new drop` and no DNAT.

src/lifecycle/raise.ts

@@ -20,7 +20,8 @@ import { machineName, macFor, networkName, newInstanceId } from "./names.ts";
 import { waitUntilAllUsable } from "./ready.ts";
 import { applyAddresses, applyDefaultRoutes } from "./address.ts";
 import { assertSupported } from "./supported.ts";
-import { planRouters, raiseRouters } from "./router.ts";
+import { planRouters, raiseRouters, raiseTransit } from "./router.ts";
+import { applyHostFirewalls } from "./firewall.ts";
 
 /** Drivers whose snapshots are copy-on-write. On `dir` a snapshot is a full copy. */
 const COW_DRIVERS = ["btrfs", "zfs"];
@@ -196,12 +197,22 @@ export async function raise(
     step = "applying declared addresses";
     await applyAddresses(scenario, instanceId, byMachine, log);
 
+    // Transit first: a gateway's default route points at it, so it has to exist.
+    step = "wiring the public networks together";
+    const transit = await raiseTransit(scenario, instanceId, log);
+
     step = "raising routers";
     const routers = await raiseRouters(scenario, instanceId, planRouters(scenario, instanceId), log);
+    if (transit) routers.push(transit);
 
     step = "routing machines through their gateways";
     await applyDefaultRoutes(scenario, byMachine, log);
 
+    // Last: a machine that refuses inbound must still have been reachable while the lab
+    // was configuring it.
+    step = "applying host firewalls";
+    await applyHostFirewalls(scenario, byMachine, log);
+
     return {
       instanceId,
       scenario: scenario.scenario,