fix(net): detect interfaces without following /sys symlinks

/sys/class/net/<if> is always a symlink into /sys/devices; in nested
containers (sysbox runtime) that target is not visible, so the link is
dead. iface_exists() used Path.exists(), which follows the link and
therefore tested the visibility of the target instead of the existence of
the interface. detect_egress_iface() discarded every interface it had
correctly read from the routing table, so automtu aborted with "Could not
detect egress interface" and rc=2 even though `ip -4 route show default`
and `ip link show dev eth0` both worked. The documented escape hatch
--egress-if was equally dead, because core.py validates it through the
same call.

Chosen fix: os.path.lexists() rather than probing netlink for existence.
It asks the right question -- "is there an entry named <if>" -- and costs
no subprocess on a healthy host. Netlink (`ip link show`) is only the
fallback for when /sys/class/net itself is unavailable, so sysfs stays the
preferred path everywhere.

read_iface_mtu() gains the same cascade: sysfs first, MTU parsed from
`ip link show dev <if>` when the sysfs path is unreadable, RuntimeError
naming both sources when neither answers - no silent default. core.py
turns that into an error line plus rc=3 instead of a traceback.

list_ifaces() had the same defect (is_dir() on a dead symlink) and would
have left Docker bridge detection blind in the same environments.

Regression tests build a /sys replacement whose class/net/eth0 points at a
missing target and mock the ip command: they fail if lexists becomes
exists again, if the MTU fallback is removed, or if the symlink filter is
dropped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/test_core.py

@@ -1,12 +1,46 @@
 import io
+import pathlib
+import tempfile
 import unittest
 from contextlib import redirect_stdout
 from types import SimpleNamespace
 from unittest.mock import patch
 
+from automtu import net
 from automtu.core import run_automtu
 
 
+def _args(**over) -> SimpleNamespace:
+    base = {
+        "dry_run": True,
+        "egress_if": None,
+        "prefer_wg_egress": False,
+        "force_egress_mtu": None,
+        "pmtu_target": None,
+        "auto_pmtu_from_wg": False,
+        "pmtu_min_payload": 1200,
+        "pmtu_max_payload": 1472,
+        "pmtu_timeout": 1.0,
+        "pmtu_policy": "min",
+        "apply_egress_mtu": False,
+        "apply_wg_mtu": False,
+        "apply_docker_mtu": False,
+        "apply_all": False,
+        "docker_if": None,
+        "docker_no_user_bridges": False,
+        "wg_if": "wg0",
+        "wg_overhead": 80,
+        "wg_min": 1280,
+        "set_wg_mtu": None,
+        "persist": None,
+        "uninstall": False,
+        "print_mtu": None,
+        "print_json": False,
+    }
+    base.update(over)
+    return SimpleNamespace(**base)
+
+
 class TestCore(unittest.TestCase):
     def test_run_automtu_happy_path_all_mocked(self) -> None:
         args = SimpleNamespace(
@@ -164,5 +198,53 @@ class TestCore(unittest.TestCase):
         mock_set.assert_not_called()
 
 
+class TestCoreInSysboxContainer(unittest.TestCase):
+    """Container with dead /sys/class/net symlinks: routing and ip link work."""
+
+    def setUp(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        root = pathlib.Path(tmp.name)
+        self.netdir = root / "class" / "net"
+        self.netdir.mkdir(parents=True)
+        for name in ("eth0", "lo"):
+            (self.netdir / name).symlink_to(root / "devices" / "virtual" / "net" / name)
+
+    @staticmethod
+    def _fake_run(cmd: list[str]) -> str:
+        if cmd[:5] == ["ip", "-4", "route", "show", "default"]:
+            return "default via 172.28.0.1 dev eth0"
+        if cmd[:3] == ["ip", "link", "show"] and cmd[-1] == "eth0":
+            return (
+                "2: eth0@if5: <BROADCAST,MULTICAST,UP> mtu 1450 qdisc noqueue state UP"
+            )
+        return ""
+
+    def test_print_mtu_effective_yields_number_and_rc0(self) -> None:
+        with (
+            patch.object(net, "SYSFS_NET", self.netdir),
+            patch.object(net, "_run", side_effect=self._fake_run),
+            patch("automtu.core.probe_pmtu", return_value=1400),
+        ):
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                rc = run_automtu(_args(pmtu_target=["1.1.1.1"], print_mtu="effective"))
+
+        self.assertEqual(rc, 0)
+        self.assertEqual(int(buf.getvalue().strip()), 1400)
+
+    def test_explicit_egress_if_is_accepted(self) -> None:
+        with (
+            patch.object(net, "SYSFS_NET", self.netdir),
+            patch.object(net, "_run", side_effect=self._fake_run),
+        ):
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                rc = run_automtu(_args(egress_if="eth0", print_mtu="egress"))
+
+        self.assertEqual(rc, 0)
+        self.assertEqual(int(buf.getvalue().strip()), 1450)
+
+
 if __name__ == "__main__":
     unittest.main(verbosity=2)