fix(net): honor socket nonblocking mode and TCP accept readiness

[fslongjin]

Summary

Fix two distinct causes of incorrect TCP accept behavior and stalled nginx workers:

• Treat only Established and CloseWait as acceptable ordinary passive opens, sharing the predicate between listener polling and accept. Capture both endpoints under the same SocketSet lock rather than looking up a potentially reset tuple later.
• Synchronize socket nonblocking mode in the common File::set_flags path. FIONBIO previously changed the file flags but left the socket's cached mode unchanged, so nginx could block in accept4 after another worker consumed listener readiness.
• Initialize the socket mode from its new open file description, preserving SOCK_NONBLOCK in socket/socketpair creation. This also keeps listener blocking behavior separate from the new socket flags supplied to accept4.
• Remove fcntl's separate socket lookup/update and add required regression suites. No nginx workaround, request retry, extra queue, or network hot-path machinery is introduced.

Root-cause evidence

On the failing guest, a request had reached an accepted TCP connection (35 unread bytes, no recv calls), while its nginx worker was sleeping in accept4 on the listener. Updating FIONBIO's common mode propagation fixes this deterministic syscall contract violation instead of masking the HTTP timeout.

The packet-controlled handshake test independently demonstrates that an unanswered SYN must not make a listener readable or acceptable, while a completed handshake followed immediately by FIN must remain acceptable.

Validation

• Linux: all 14 new tests pass.
• Pre-fix guest: the handshake test exposes premature accept; nonblocking tests expose two blocking listener calls and four incorrect creation flag cases.
• Fixed DragonOS guest: 235 focused regression tests pass, including the 14 new cases and existing TCP/UDP, dual-stack, UNIX socket, fcntl, epoll, readv, and inotify tests.
• nginx 1.24.0, two workers, guest-local HTTP: 30,000/30,000 requests after regressions plus 10,000/10,000 after a fresh guest boot. Both use 16 concurrent clients, a five-second per-request deadline, response validation, and no retries.
• make kernel, make fmt, FMT_CHECK=1 make fmt, and git diff --check pass.
• Independent adversarial reviews of concurrency/security, correctness, and architecture/performance found no blocking issues.

This validates the reproduced guest-local failure; historical host-forwarding timeouts are not claimed to be fixed by this patch.

[fslongjin]

@codex review

[fslongjin]

Fixed the CI failure in 82ea132. The three handshake failures exposed a veth ingress bug: AF_PACKET delivery occurred only for frames reaching the local smoltcp RxToken, after routing/bridge consumers could already discard them. The patch moves ingress packet taps before classification and removes the old delivery to avoid duplicates. The handshake tests now require actual PACKET_HOST replies instead of accepting incidental forwarded OUTGOING copies. Reproduced all three failures on the previous kernel; Linux passes the strengthened tests. The fixed guest passes 321 focused network regressions and 60 additional handshake cases under the previously failing peer route. Build and formatting checks pass. No tests were skipped and no timeouts were relaxed.

[fslongjin]

@codex review