Survive a stopped dockerd; report unexpected failures

- no docker0 yet (dockerd is socket-activated and starts on first use): fall back to the
  default gateway instead of exiting silently under pipefail
- an ERR trap in the main process prints file, line and command of an unhandled failure
- egress layers list returns success when the last layer is absent
- drop the stale OCSB_EGRESS_BASE from the settings list (broke `config`)

bin/opencode-sandbox

@@ -2,7 +2,10 @@
 # opencode-sandbox — run OpenCode 2 for a project inside a sandbox:
 #   egress filter (squid in a container) + netlock (nftables by group) + bubblewrap.
 # See README.md. Start with: opencode-sandbox help
-set -euo pipefail
+set -Eeuo pipefail
+# A failure nobody handled: say where, instead of exiting silently. Main process only: in
+# subshells ($(...), <(...)) a non-zero status is the parent's to judge
+trap '[[ ${BASHPID} != "$$" ]] || echo "opencode-sandbox: unexpected failure at ${BASH_SOURCE[0]##*/}:${LINENO}: ${BASH_COMMAND}" >&2' ERR
 
 OCSB_HOME="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
 export OCSB_HOME

lib/common.sh

@@ -21,7 +21,7 @@ OCSB_SCALARS=(
   OCSB_NAME OCSB_WEB_PORT OCSB_EGRESS_PORT OCSB_NETLOCK_GROUP OCSB_SANDBOX OCSB_PANEL
   OCSB_NOTIFICATIONS OCSB_TMP OCSB_DISPLAY OCSB_OPENCODE_BIN OCSB_ENV_FILE OCSB_KUBECONFIG OCSB_PASSWORD_FILE
   OCSB_WORKTREES_DIR OCSB_WT_PREFIX OCSB_WT_BASE OCSB_WT_SLUG_REGEX OCSB_DOCKER_GW
-  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG OCSB_EGRESS_BASE
+  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG
 )
 OCSB_ARRAYS=(OCSB_RW OCSB_RW_HOME OCSB_HIDE OCSB_HIDE_HOME OCSB_SKILLS OCSB_SKILL_DIRS OCSB_PLUGINS OCSB_ENV)
 
@@ -140,7 +140,8 @@ ocsb_derive() {
     OCSB_WORKTREES_DIR=$(ocsb_abs "${OCSB_WORKTREES_DIR}")
   fi
   if [[ -z ${OCSB_DOCKER_GW} ]]; then
-    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1)
+    # docker0 appears only once dockerd runs (socket activation starts it on first use)
+    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1) || true
     OCSB_DOCKER_GW=${OCSB_DOCKER_GW:-172.17.0.1}
   fi
   OCSB_CONTAINER="opencode-sandbox-egress-${OCSB_NAME}"

lib/egress.sh

@@ -26,6 +26,7 @@ ocsb_egress_layers() {
     "${OCSB_PROJECT_DIR}/.opencode-sandbox/local/egress.conf"; do
     [[ -f ${f} ]] && echo "${f}"
   done
+  return 0
 }
 
 # Prints "directive<TAB>arg" for every argument of every rule line