test(integration): harden post-create exec test vs echo-proxy bring-up race (bd openlock-eh8)

[vessux]

What

Fixes the recurring exit-56 live-integration flake (bd openlock-eh8) that went red on three consecutive main pushes (#52, #53, #54), each time passing on retry.

Root cause (prior diagnosis was wrong)

The earlier theory was an "ssh transport delivered no data / supervisor stdout-over-ssh delivery race." That's incorrect:

• ssh relays the remote command's exit status. ssh's own transport failures exit 255, never 56. So ssh exited with status 56 ⇒ the remote curl exited 56 = CURLE_RECV_ERROR (and the historical 35 = CURLE_SSL_CONNECT_ERROR).
• The "empty stdout AND stderr" was just curl -s muting curl's error message — not a dropped transport. The supervisor/ssh path worked fine; it carried curl's exit code back faithfully.

The real cause is curl racing the in-container echo-proxy + CA-bundle bring-up on the first egress. This was already diagnosed and mitigated in the two sibling echo-mode tests (harness-cred-inject, openrouter-opencode-cred-inject) via --retry 5 --retry-all-errors --retry-delay 1 (added in #38) — their comment literally says "transient TLS/network failures (exit 35/56) … races the supervisor's CA-bundle + echo-proxy bring-up."

post-create-exec-proxy.test.ts (added in #34 for openlock-hnp, the post-create sandbox exec path) never received that hardening — it was the one test still on bare curl -sf, which is exactly why it became the new flake locus. It even waits for waitForSandboxReady first, confirming that readiness (/bin/true execs) ≠ egress/proxy ready.

Change

• Add --retry 5 --retry-all-errors --retry-delay 1 to post-create-exec-proxy.test.ts, matching its siblings. (Doesn't weaken the routing assertion — a real proxy-bypass regression still fails after retries.)
• Switch all three flaking tests -sf → -sSf so a retries-exhausted failure surfaces curl's real error instead of muting it.

Verification

• bun run lint ✅ (exit 0) · bun run typecheck ✅ · bun test unit delta zero (the three edited tests are skipIf(!LIVE)).
• The fix is exercised by live-integration(podman) on this PR — the job where the flake actually reproduces.

Follow-up

Filed openlock-g4x (P3): the test --retry masks the bring-up race, but the production attach path may expose a real harness to the same first-egress transient. Worth an egress-aware readiness probe — but pin whether prod is actually exposed before adding product-side retries.