#4043 feat(limrun): capture session traffic into a live HAR and report tunnel failures

Summary

connect limrun --provider-network-logs writes a live HAR 1.2 file of device traffic through Limrun's tunnel inspection. --provider-network-hosts narrows the capture to named hosts. The SDK logged tunnel failures only to the console. The capture now records typed failure kinds (request-failed with host:port, inspection-error, inspection-gap, inspection-stream-error, har-write-failed, har-truncated) plus the tunnel's typed lastDialFailure.reason. artifacts and close print a summary, and artifacts --json carries the report. A capture that can't start is an unavailable artifact with its reason.

The capture is bounded: bodies are cut to 64 KiB, the file to 8 MiB, and writes are async with one in flight. The HAR is owner-only, named per lease, and deleted when its record is evicted. The docs cover the egress, sensitivity, pinning, DoH and HTTP/2-only limits. 36 files, 10 commits. Follow-up: #4064. Upstream evidence is in a comment.

agent-device connect limrun --platform ios --provider-network-logs --provider-network-hosts "api.example.com,localhost:8081"
agent-device artifacts

Validation

• check:affected --run at a597bf451e failed only on ios-record-trace timeouts (they also fail on base; host load average about 70). 14 static gates pass via pnpm gate. CI was all green at e812372756.
• Live Limrun iOS at a597bf451e with --provider-network-hosts httpbin.org,agent-device-missing-q7z.com. jq read mid-session:

  200 GET https://httpbin.org/get
  0 GET https://agent-device-missing-q7z.com/ …client_dial_failed
  Network capture failures: 2; request-failed 2, latest agent-device-missing-q7z.com:443 (…); last dial failure dns_not_found
  

  close printed the same summary, and HAR mode is -rw-------. An invalid host showed unavailable. No instances were left.

🤖 Generated with Claude Code