Survive a stopped dockerd; report unexpected failures

- no docker0 yet (dockerd is socket-activated and starts on first use): fall back to the
  default gateway instead of exiting silently under pipefail
- an ERR trap in the main process prints file, line and command of an unhandled failure
- egress layers list returns success when the last layer is absent
- drop the stale OCSB_EGRESS_BASE from the settings list (broke `config`)

lib/common.sh

@@ -21,7 +21,7 @@ OCSB_SCALARS=(
   OCSB_NAME OCSB_WEB_PORT OCSB_EGRESS_PORT OCSB_NETLOCK_GROUP OCSB_SANDBOX OCSB_PANEL
   OCSB_NOTIFICATIONS OCSB_TMP OCSB_DISPLAY OCSB_OPENCODE_BIN OCSB_ENV_FILE OCSB_KUBECONFIG OCSB_PASSWORD_FILE
   OCSB_WORKTREES_DIR OCSB_WT_PREFIX OCSB_WT_BASE OCSB_WT_SLUG_REGEX OCSB_DOCKER_GW
-  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG OCSB_EGRESS_BASE
+  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG
 )
 OCSB_ARRAYS=(OCSB_RW OCSB_RW_HOME OCSB_HIDE OCSB_HIDE_HOME OCSB_SKILLS OCSB_SKILL_DIRS OCSB_PLUGINS OCSB_ENV)
 
@@ -140,7 +140,8 @@ ocsb_derive() {
     OCSB_WORKTREES_DIR=$(ocsb_abs "${OCSB_WORKTREES_DIR}")
   fi
   if [[ -z ${OCSB_DOCKER_GW} ]]; then
-    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1)
+    # docker0 appears only once dockerd runs (socket activation starts it on first use)
+    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1) || true
     OCSB_DOCKER_GW=${OCSB_DOCKER_GW:-172.17.0.1}
   fi
   OCSB_CONTAINER="opencode-sandbox-egress-${OCSB_NAME}"