Merge nucleic/olive-ember-seal-q7vk into dev

packages/nucleic-bridge/control

@@ -0,0 +1,12 @@
+Package: nucleic-bridge
+Version: @VERSION@
+Architecture: all
+Maintainer: Nucleic <[email protected]>
+Section: net
+Priority: optional
+Depends: nodejs
+Description: in-container control bridge (docs/VSOCK_CONTROL_PLANE.md)
+ Loopback TCP to the vsock-relayed host control socket, so the agent and the
+ interceptor shims reach the host approval server with no IP listener.
+ Launched by naros-init (or the container's root init) only when Nucleic
+ relays a control socket in.

packages/nucleic-bridge/stage.sh

@@ -0,0 +1,6 @@
+# The bridge source of truth stays beside the sandbox image context; the deb packages it.
+stage() {
+  local dest="$1"
+  install -D -m 0644 "$OS_DIR/../containers/nucleic-sandbox/control-bridge.js" \
+    "$dest/opt/nucleic/control-bridge.js"
+}