test(e2e): run the firecracker suite by default and reap its leaked VMs

[Shine-neko]

The firecracker e2e suite (9 scenarios) existed but was not in the default set of tests/e2e/run.sh, so it only ran when named explicitly. Unlike the containerd exclusion — which is documented and justified by its root/CNI requirements — this one was neither. Cloud Hypervisor is in the default set with the same shape of prerequisites (/dev/kvm plus a VMM binary, each setup.sh exiting non-zero with an install hint when they are missing), so Firecracker joins it. A host lacking the prerequisites now reports a clear failure instead of silently skipping the least mature runtime's coverage.

cleanup_between_tests also did not reap Firecracker VMs. A test killed before its own EXIT trap runs leaves a live VM holding its tap and its /30, and the next test that hashes to the same network slot then fails on a name already taken. Verified on a host with firecracker and /dev/kvm: interrupting a test does leave firecracker processes behind, and the added pkill reaps them.

The kill is scoped to the suite's own socket directory (ring-e2e-fc-sockets-*) rather than every firecracker process. The existing kills in this function are unscoped, but a container runtime's daemon is not comparable to a microVM: one running on this host may well belong to something other than the test suite.

One gap is left open and documented in place. Killing a VM does not remove its tap, which is persistent. The suite already reaps those itself — setup.sh snapshots ring-* interfaces before the run and deletes what appeared, via an EXIT trap — but if a test is killed hard enough to skip that trap, the leaked tap is already present when the next test snapshots, so it is treated as pre-existing and never reaped. Deleting every ring-* from run.sh would close it, at the risk of taking down a tap belonging to a concurrent Ring: the tap name is a hash of the instance id, with nothing in it to tell a test VM from a real one. Not worth trading a leaked interface for a broken workload.

Tests

bash -n clean. Ran the Firecracker suite on a host with the prerequisites: the tests fail there for lack of CAP_NET_ADMIN on the test binary (setcap cap_net_admin+ep needs interactive sudo), which is an environment limit rather than a code one. What the run did confirm is that the error path is correct end to end — TapDevice::create reports the exact remedy, the failure classifies as retryable, restart_count climbs toward its bound, and no tap is leaked across repeated failures.