Runner smoke: surface relay-enroll failure cause + curl egress probe

The runner image smoke test only reported an opaque "challenge request"
when nucleicd failed to enroll with the relay on boot. RelayAccess.postJSON
collapsed transport errors, non-200 statuses, and malformed bodies into one
string, hiding whether the fully-static musl binary's URLSession/libcurl leg
is failing vs the relay rejecting vs no egress. Surface the specific cause,
and add an independent curl probe to the smoke step so one build tells us
which layer is at fault.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.github/workflows/runner-image.yml

@@ -68,6 +68,16 @@ jobs:
         run: |
           chmod +x containers/nucleic-runner/nucleicd
           file containers/nucleic-runner/nucleicd
+          # Independent egress probe: can THIS runner reach the relay's enroll endpoint, and what
+          # does it answer? Isolates a runner-network/relay problem from a Swift-binary (static-musl
+          # URLSession/libcurl) problem — the daemon's own enroll POST goes through URLSession.
+          echo "----- relay egress probe (curl) -----"
+          curl -sS -m 15 -o /tmp/relay.out -w 'HTTP %{http_code} in %{time_total}s\n' \
+            -X POST https://relay.nucleic.blakeslee.xyz/v1/relay/enroll/challenge \
+            -H 'content-type: application/json' -d '{"staticKey":"probe"}' \
+            || echo "curl failed: exit $?"
+          head -c 400 /tmp/relay.out 2>/dev/null; echo
+          echo "-------------------------------------"
           # Don't let `set -e` abort before we've printed the log: capture the exit code, then
           # decide. `timeout` returns 124 when it had to kill a still-running daemon (the healthy
           # case — nucleicd runs forever); a clean SIGTERM shutdown returns 0. Any other code is a