Add integration tests based on testcontainers

src/app.rs

@@ -1462,6 +1462,33 @@ impl Application {
         )
     }
 
+    /// Test-only adapter boundary for Alpine fixture apply. The supplied
+    /// callback must report a completed fixture operation; observation and
+    /// verification still use the real Rustix reader and normal persistence
+    /// path. This method is not present in production builds.
+    #[cfg(test)]
+    #[allow(dead_code)] // Consumed by the M8.5 in-container scenario driver.
+    pub(crate) fn restart_with_fixture_apply(
+        &mut self,
+        preview: RestartPreview,
+        choice: RestartChoice,
+        fixture_apply: impl FnOnce(&str, RestartDeadline) -> RestartExecution,
+    ) -> RestartReport {
+        self.restart_with_adapters(
+            preview,
+            choice,
+            fixture_apply,
+            |interface, timeout| {
+                runtime::transport::observe_interface(
+                    interface,
+                    timeout,
+                    runtime::netlink::DecodeLimits::default(),
+                )
+            },
+            |store, saved, backup| store.install(saved, backup),
+        )
+    }
+
     fn restart_with_adapters_and_clock(
         &mut self,
         preview: RestartPreview,

src/lib.rs

@@ -10,3 +10,8 @@ pub mod startup;
 pub mod tui;
 pub mod vault;
 pub mod wireguard;
+
+// This driver is compiled only into the library test harness. In particular,
+// the normal executable has no fixture apply path.
+#[cfg(test)]
+mod container_driver;