test(e2e): dump the IMDS datapath when a restarted guest never answers SSH

A stop/start that leaves the guest stuck in cloud-init-local waiting on
IMDS fails the restart SSH probe, but the diagnostics only captured the
EIP/OVN side, which was healthy. Capture br-imds flows, the endpoint's
link, addresses, sysctls, reply rule and route, the responder listener
and conntrack too, so the next occurrence names the broken hop.

tests/e2e/harness/imds_diag.go

@@ -51,6 +51,23 @@ func DumpIMDSDatapathDiagnostics(t *testing.T, subnetID, guestIP, artifactDir st
 				"list", "Port_Binding"},
 			grepFor: []string{guestIP},
 		},
+		{
+			filename: "imds-endpoint-links.txt",
+			label:    "ip -br link (endpoint up, MAC matching the demux flow's mod_dl_dst?)",
+			argv:     []string{"ip", "-br", "link", "show"},
+			grepFor:  []string{"ime-"},
+		},
+		{
+			filename: "imds-endpoint-addrs.txt",
+			label:    "ip -br addr (endpoint owns 169.254.169.254/.253?)",
+			argv:     []string{"ip", "-br", "addr", "show"},
+			grepFor:  []string{"ime-"},
+		},
+		{
+			filename: "imds-endpoint-sysctls.txt",
+			label:    "endpoint rp_filter/accept_local (a strict rp_filter drops guest requests)",
+			argv:     []string{"sysctl", "-a", "-r", `conf\.(all|default|ime-.*)\.(rp_filter|accept_local)$`},
+		},
 		{
 			filename: "imds-reply-rules.txt",
 			label:    "ip rule (per-tap 'oif <endpoint> lookup <table>' reply rule present?)",

tests/e2e/single/vpcegress_test.go

@@ -735,6 +735,8 @@ func runVPCEgressPaths(t *testing.T, fix *Fixture) {
 					LogicalIP:   pubPrivIP,
 					ArtifactDir: fix.ArtifactDir(t),
 				})
+			// A restarted guest that never reaches IMDS stalls in cloud-init before sshd starts.
+			harness.DumpIMDSDatapathDiagnostics(t, pubSubnetID, pubPrivIP, fix.ArtifactDir(t))
 			t.Fatalf("guest unreachable via %s within %s after restart (see diagnostics above)", newIP, harness.SSHReadyBudget)
 		}
 		out := harness.RunSSH(t, harness.SSHTarget{User: "ubuntu", Host: newIP, Port: 22, KeyPath: keyPath}, "id")
@@ -859,6 +861,8 @@ func runVPCEgressPaths(t *testing.T, fix *Fixture) {
 						LogicalIP:   aws.StringValue(started.PrivateIpAddress),
 						ArtifactDir: fix.ArtifactDir(t),
 					})
+				// A restarted guest that never reaches IMDS stalls in cloud-init before sshd starts.
+				harness.DumpIMDSDatapathDiagnostics(t, pubSubnetID, aws.StringValue(started.PrivateIpAddress), fix.ArtifactDir(t))
 				t.Fatalf("guest unreachable via EIP %s within %s after restart (see diagnostics above)", eipIP, harness.SSHReadyBudget)
 			}
 			out := harness.RunSSH(t, harness.SSHTarget{User: "ubuntu", Host: eipIP, Port: 22, KeyPath: keyPath}, "id")