feat(ci-ansible): netbird client and netbird-join for mesh SSH

Step 1 of SSH-only-over-NetBird: a deploy step joins the mesh as an
ephemeral peer (netstack, no TUN, no NET_ADMIN) and reaches hosts
through the client's SOCKS5 on 127.0.0.1:1080:
  ProxyCommand nc -X 5 -x 127.0.0.1:1080 %h %p

- netbird 0.75.0 copied from the rootless image netbird-ingress runs
  (same digest), plus netcat-openbsd for SOCKS5.
- netbird-join starts the daemon, runs up with NB_SETUP_KEY bounded by
  a timeout (up retries a rejected key for minutes), waits for
  'Management: Connected' and prints the daemon log on any failure.

Tested locally: image builds, netbird version 0.75.0, nc -X 5 present;
with a dummy key the join reaches netbird.renner.uno, gets 'setup key
is invalid', and fails after the timeout with the log. Not yet run with
a real key, so the connected-status match is unverified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci/images/ansible/Containerfile

@@ -1,5 +1,12 @@
+# NetBird client for joining a deploy step to the mesh (netbird-join); same
+# image and version as the cluster's netbird-ingress peers.
+FROM docker.io/netbirdio/netbird:v0.75.0-rootless@sha256:da35ab6e4ae753c14f7fb85adedcbd5b05045c698973dfa20c3f7567b5566fbf AS netbird
+
 FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 
+COPY --from=netbird /usr/local/bin/netbird /usr/local/bin/netbird
+COPY netbird-join /usr/local/bin/netbird-join
+
 RUN apk add --no-cache \
       ansible \
       aws-cli \
@@ -9,6 +16,7 @@ RUN apk add --no-cache \
       curl \
       git \
       jq \
+      netcat-openbsd \
       openssh-client \
       openssl \
       python3 \

ci/images/ansible/netbird-join

@@ -0,0 +1,58 @@
+#!/bin/sh
+# Join this CI step to the NetBird mesh as an ephemeral peer and wait until it
+# is connected. Netstack mode: no TUN device, no NET_ADMIN. The client serves
+# SOCKS5 on 127.0.0.1:1080, inside this container only; ssh reaches mesh hosts
+# with
+#   ProxyCommand nc -X 5 -x 127.0.0.1:1080 %h %p
+#
+# Needs NB_SETUP_KEY: an ephemeral setup key whose auto-group may reach the
+# hosts' tcp/22. The peer disappears ~10 minutes after the step ends.
+set -eu
+
+: "${NB_SETUP_KEY:?NB_SETUP_KEY is not set}"
+NB_MANAGEMENT_URL="${NB_MANAGEMENT_URL:-https://netbird.renner.uno}"
+TIMEOUT="${NETBIRD_JOIN_TIMEOUT:-90}"
+
+export NB_USE_NETSTACK_MODE=true
+export NB_DISABLE_DNS=true
+export NB_LOG_FILE=console
+export NB_STATE_DIR=/tmp/netbird
+export NB_DAEMON_ADDR=unix:///tmp/netbird/netbird.sock
+mkdir -p "$NB_STATE_DIR"
+
+# NB_CONFIG belongs to the daemon only; the up command warns it is deprecated there.
+NB_CONFIG="$NB_STATE_DIR/config.json" netbird service run > "$NB_STATE_DIR/daemon.log" 2>&1 &
+
+i=0
+until [ -S /tmp/netbird/netbird.sock ]; do
+  i=$((i + 1))
+  if [ "$i" -gt "$TIMEOUT" ]; then
+    echo "netbird-join: daemon did not start" >&2
+    cat "$NB_STATE_DIR/daemon.log" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
+# up retries a rejected key for minutes before failing; bound it.
+if ! timeout "$TIMEOUT" netbird up \
+    --setup-key "$NB_SETUP_KEY" \
+    --management-url "$NB_MANAGEMENT_URL" \
+    --hostname "ci-${CI_PIPELINE_NUMBER:-local}-${CI_STEP_NAME:-step}"; then
+  echo "netbird-join: netbird up failed or timed out after ${TIMEOUT}s" >&2
+  cat "$NB_STATE_DIR/daemon.log" >&2
+  exit 1
+fi
+
+i=0
+until netbird status | grep -q '^Management: Connected'; do
+  i=$((i + 1))
+  if [ "$i" -gt "$TIMEOUT" ]; then
+    echo "netbird-join: not connected after ${TIMEOUT}s" >&2
+    netbird status >&2 || true
+    cat "$NB_STATE_DIR/daemon.log" >&2
+    exit 1
+  fi
+  sleep 1
+done
+netbird status | grep -E '^(Management|Signal|NetBird IP|Peers count):'