Make the gateway integration suite safe for concurrent CI runs

gateway-lan pinned 172.20.1.0/24 and fd02::/64, so two concurrent local CI
runs collided on "Pool overlaps" at network creation. The IPv4 subnet has no
consumer -- the whole gateway LAN path is IPv6 -- so drop it and let docker
auto-assign. The IPv6 side cannot float, because the LAN clients' resolv.conf
pins the gateway's address as their nameserver and that must be a literal
known before they start, so claim a free /64 per run and thread the prefix
through the compose address pins, a generated resolv.conf, and the test via a
single exported variable.

The claim and the external network ship as a harness-only compose overlay
applied by run_gateway; the base compose keeps a normal gateway-lan network,
so the GitHub matrix and any standalone bring-up are unaffected. With no claim
every address renders exactly as before.

testing/static/docker-compose.yml

@@ -8,6 +8,10 @@ networks:
     driver: bridge
     labels:
       - "com.corganlabs.fips-ci=1"
+  # IPv4 is dropped so docker auto-assigns it (nothing reads a LAN IPv4 — the
+  # whole gateway LAN path is IPv6). The fd02::/64 pin stays for the standalone /
+  # GitHub path; concurrent local runs replace this network with a per-run
+  # claimed /64 via docker-compose.gateway-external-net.yml (see run_gateway).
   gateway-lan:
     driver: bridge
     labels:
@@ -15,7 +19,6 @@ networks:
     enable_ipv6: true
     ipam:
       config:
-        - subnet: 172.20.1.0/24
         - subnet: fd02::/64
 
 x-fips-common: &fips-common
@@ -475,8 +478,7 @@ services:
     networks:
       fips-net:
       gateway-lan:
-        ipv4_address: 172.20.1.10
-        ipv6_address: fd02::10
+        ipv6_address: ${FIPS_GW_LAN6_PREFIX:-fd02}::10
 
   gw-server:
     <<: *fips-common
@@ -513,11 +515,10 @@ services:
     sysctls:
       - net.ipv6.conf.all.disable_ipv6=0
     volumes:
-      - ./configs/gateway-resolv.conf:/etc/resolv.conf:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/resolv.conf:/etc/resolv.conf:ro
     networks:
       gateway-lan:
-        ipv4_address: 172.20.1.20
-        ipv6_address: fd02::20
+        ipv6_address: ${FIPS_GW_LAN6_PREFIX:-fd02}::20
     restart: "no"
     env_file:
       - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env
@@ -535,11 +536,10 @@ services:
     sysctls:
       - net.ipv6.conf.all.disable_ipv6=0
     volumes:
-      - ./configs/gateway-resolv.conf:/etc/resolv.conf:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/resolv.conf:/etc/resolv.conf:ro
     networks:
       gateway-lan:
-        ipv4_address: 172.20.1.21
-        ipv6_address: fd02::21
+        ipv6_address: ${FIPS_GW_LAN6_PREFIX:-fd02}::21
     restart: "no"
     env_file:
       - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env