AD-002 — Attach at pod parent cgroup, skip UID 1337

Decision: Attach connect4/sockops at the pod common parent cgroup v2; achieve loop avoidance by running the entire sidecar as UID 1337 and skipping UID 1337 in connect4.
Reason: A single parent cgroup covers both containers in the pod; the UID-1337 skip keeps the sidecar's own egress from being re-redirected.
Trade-off: Requires a host cgroup namespace (--cgroupns=host) and a strict whole-sidecar UID discipline.
Scope: Features 01 (redirect) and 03 (harness).
Date: 2026-09-09
Status: active