bug: a transient accept error ends the boundary control listener or the DNS TCP relay #5183

User Story

I run OpenShell sandboxes with the Podman and Kubernetes drivers, and I read through the isolation core (openshell-sandbox, openshell-binary-identity, openshell-isolation-interface) at 00528d24a. This item comes from reading the code. I have not hit it in production. It is one line of the umbrella issue #5179.

Problem Statement

Two accept loops treat any error as fatal:

• crates/openshell-sandbox/src/boundary_server.rs:663: the control listener returns Err("accept boundary control connection: ...") for any accept error other than the handled benign kinds, which ends the boundary. EMFILE (and ENFILE) are transient and recoverable.
• crates/openshell-sandbox/src/network_broker.rs:479: the openshell-dns-tcp thread breaks out of for accepted in tcp.incoming() on any accept or peer_addr error, including a connection reset before accept (ENOTCONN) and EMFILE. The relay then stops serving TCP DNS for the rest of the sandbox's life.

Impact / Why This Matters

A transient resource error takes down the control endpoint (the sandbox exits) or silently disables TCP DNS for the remaining lifetime of the sandbox, instead of being retried.

Acceptance Criteria

• The control listener retries EMFILE/ENFILE/ENOBUFS/ENOMEM with a short backoff and logs, and only unrecoverable errors end the boundary.
• The DNS TCP loop skips a connection that resets before peer_addr and retries on resource errors, and keeps serving.
• Unit tests inject these errors.

Reproduction Steps

Found by reading the code; not reproduced live. A unit test can inject EMFILE and a reset-before-accept into the two accept loops and assert they keep serving.

Environment

• OpenShell: main at 00528d24a
• OS: Fedora 44, Linux 7.2.14
• Deployment: Podman driver (local gateway); code read for the Kubernetes driver too