Stop the DNS resolver e2e tests certifying a binary that was never built

The e2e scenarios build fips and fips-gateway in a builder image and extract them with two docker cp calls whose stderr went to /dev/null and whose exit status was never tested. Because build_fips_for_e2e ended in a log call it returned 0 on every path, so the caller's guard could not fire. A failed extraction left the previous run's binaries in the cache, they satisfied the caller's executable check, and the five e2e legs then exercised the previous commit's code and reported green.

The extraction now deletes the cached binaries before it starts, which is what makes the stale case impossible rather than merely detected, and it checks each docker cp independently, reports the failure with docker's own message, verifies each extracted file is non-empty and executable, and returns an explicit status. This mirrors what the deb-install suite already does.

Confirmed by inducing the failure rather than by observing a green run. With both extractions broken and a stale binary in place, the old code logged "Cached fips (26936 bytes)" and went on to build the runtime image around it; the new code reports both docker errors, deletes the stale binaries and fails the suite. Breaking either extraction on its own is caught separately, and an unmodified run passes 7 of 7.

testing/dns-resolver/test.sh

@@ -270,13 +270,43 @@ DOCKERFILE
     fi
 
     log "Extracting fips + fips-gateway binaries from builder image"
-    local cid
-    cid=$(docker create "$builder_tag")
-    docker cp "$cid:/src/target/release/fips" "$FIPS_BIN_CACHE" >/dev/null 2>&1
-    docker cp "$cid:/src/target/release/fips-gateway" "$FIPS_GATEWAY_BIN_CACHE" >/dev/null 2>&1
+    # Drop the previous run's binaries before extracting. Without this, a failed
+    # extraction below leaves them in place, they satisfy the caller's -x check,
+    # and the e2e scenarios silently exercise the previous commit's code.
+    rm -f "$FIPS_BIN_CACHE" "$FIPS_GATEWAY_BIN_CACHE"
+
+    local cid err
+    if ! cid=$(docker create "$builder_tag" 2>&1); then
+        echo "  ERROR: docker create failed: $cid"
+        return 1
+    fi
+
+    local rc=0 spec bin dest
+    for spec in "fips:$FIPS_BIN_CACHE" "fips-gateway:$FIPS_GATEWAY_BIN_CACHE"; do
+        bin="${spec%%:*}"
+        dest="${spec#*:}"
+        if ! err=$(docker cp "$cid:/src/target/release/$bin" "$dest" 2>&1); then
+            echo "  ERROR: extracting $bin from the builder image failed: $err"
+            rc=1
+        fi
+    done
     docker rm "$cid" >/dev/null
-    chmod +x "$FIPS_BIN_CACHE" "$FIPS_GATEWAY_BIN_CACHE"
+    [ "$rc" -eq 0 ] || return 1
+
+    if ! chmod +x "$FIPS_BIN_CACHE" "$FIPS_GATEWAY_BIN_CACHE"; then
+        echo "  ERROR: chmod +x failed on the extracted binaries"
+        return 1
+    fi
+
+    for dest in "$FIPS_BIN_CACHE" "$FIPS_GATEWAY_BIN_CACHE"; do
+        if [ ! -s "$dest" ] || [ ! -x "$dest" ]; then
+            echo "  ERROR: extracted binary missing, empty or not executable: $dest"
+            return 1
+        fi
+    done
+
     log "Cached fips ($(stat -c %s "$FIPS_BIN_CACHE") bytes) + fips-gateway ($(stat -c %s "$FIPS_GATEWAY_BIN_CACHE") bytes)"
+    return 0
 }
 
 # ─────────────────────────────────────────────────────────────────────