Merge branch 'maint'

.github/workflows/ci.yml

@@ -424,12 +424,6 @@ jobs:
           - suite: rekey-outbound-only
             type: rekey-outbound-only
             topology: rekey-outbound-only
-          # ── Inbound max_peers admission-cap test ───────────────────────
-          - suite: admission-cap
-            type: admission-cap
-            topology: mesh
-          - suite: acl-allowlist
-            type: acl-allowlist
           # ── Firewall baseline (fips0 nftables default-deny) ────────────
           - suite: firewall
             type: firewall
@@ -438,9 +432,6 @@ jobs:
             type: gateway
             topology: gateway
           # ── Chaos / stochastic scenarios ───────────────────────────────────
-          - suite: chaos-smoke-10
-            type: chaos
-            scenario: smoke-10
           - suite: churn-mixed-10
             type: chaos
             scenario: churn-mixed
@@ -671,21 +662,6 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile rekey-outbound-only down --volumes --remove-orphans
 
-      # ── ACL allowlist integration test ─────────────────────────────────────
-      - name: Run ACL allowlist integration test
-        if: matrix.type == 'acl-allowlist'
-        run: bash testing/acl-allowlist/test.sh --skip-build --keep-up
-
-      - name: Collect logs on failure (acl-allowlist)
-        if: matrix.type == 'acl-allowlist' && failure()
-        run: |
-          docker compose -f testing/acl-allowlist/docker-compose.yml logs --no-color
-
-      - name: Stop containers (acl-allowlist)
-        if: matrix.type == 'acl-allowlist' && always()
-        run: |
-          docker compose -f testing/acl-allowlist/docker-compose.yml down --volumes --remove-orphans
-
       # ── Firewall baseline integration test ─────────────────────────────────
       - name: Run firewall baseline integration test
         if: matrix.type == 'firewall'
@@ -816,42 +792,6 @@ jobs:
           docker compose -f testing/static/docker-compose.yml \
             --profile gateway down --volumes --remove-orphans
 
-      # ── Inbound max_peers admission-cap integration test ────────────────
-      # Lowers node.max_peers on one mesh node and asserts the inbound cap
-      # holds under sustained retry pressure: denied peers keep retrying but
-      # are never promoted to an active session. The admission-cap-test.sh
-      # assertions are tailored per link-layer handshake variant; the leg
-      # itself is uniform. Static-style harness on the shared mesh profile.
-      - name: Generate configs (admission-cap)
-        if: matrix.type == 'admission-cap'
-        run: bash testing/static/scripts/generate-configs.sh mesh
-
-      - name: Inject admission-cap config (admission-cap)
-        if: matrix.type == 'admission-cap'
-        run: bash testing/static/scripts/admission-cap-test.sh inject-config
-
-      - name: Start containers (admission-cap)
-        if: matrix.type == 'admission-cap'
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile mesh up -d
-
-      - name: Run admission-cap test
-        if: matrix.type == 'admission-cap'
-        run: bash testing/static/scripts/admission-cap-test.sh
-
-      - name: Collect logs on failure (admission-cap)
-        if: matrix.type == 'admission-cap' && failure()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile mesh logs --no-color | tail -300
-
-      - name: Stop containers (admission-cap)
-        if: matrix.type == 'admission-cap' && always()
-        run: |
-          docker compose -f testing/static/docker-compose.yml \
-            --profile mesh down --volumes --remove-orphans
-
       # ── Real-deb install integration ────────────────────────────────────
       # The deb-install harness builds its own .deb from source in a
       # cargo-deb builder image; the pre-built Linux binary from the