fix: DOCKER-USER rules for inbound relay, add UDP test playbooks

Root cause: Docker FORWARD chain policy DROP blocked all DNAT'd relay
traffic (UDP/TCP 8001, UDP 9000-9025) to the kind node. The DOCKER
chain only ACCEPTs specific TCP ports (6443, 443, 80). Added ACCEPT
rules in DOCKER-USER chain which runs before all Docker chains.

Changes:
- ashburn-relay-biscayne.yml: add DOCKER-USER ACCEPT rules (inbound
  tag) and rollback cleanup
- ashburn-relay-setup.sh.j2: persist DOCKER-USER rules across reboot
- relay-inbound-udp-test.yml: controlled e2e test — listener in kind
  netns, sender from kelce, assert arrival
- relay-link-test.yml: link-by-link tcpdump captures at each hop
- relay-test-udp-listen.py, relay-test-udp-send.py: test helpers
- relay-test-ip-echo.py: full ip_echo protocol test
- inventory/kelce.yml, inventory/panic.yml: test host inventories
- test-ashburn-relay.sh: add ip_echo UDP reachability test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/test-ashburn-relay.sh

@@ -59,7 +59,7 @@ run_test() {
   shift
   ansible biscayne -i "$BISCAYNE_INV" -m ansible.builtin.shell \
     -a "nsenter --net --target $KIND_PID python3 /tmp/$name $*" \
-    --become 2>&1 | grep -E '^OK|^TIMEOUT|^ERROR|^REFUSED|^NOTE' || echo "NO OUTPUT"
+    --become 2>&1 | grep -E '^OK|^TIMEOUT|^ERROR|^REFUSED|^NOTE|^FAIL' || echo "NO OUTPUT"
 }
 
 echo "=== Ashburn Relay End-to-End Test ==="
@@ -102,6 +102,23 @@ else
 fi
 echo ""
 
+# Test 4: ip_echo UDP reachability — the actual validator startup check
+# Sends correct ip_echo protocol to entrypoint, which probes our UDP port.
+# This is the path that causes CrashLoopBackOff when broken.
+# Triggers: outbound TCP dport 8001 (mangle mark → tunnel → SNAT)
+#           inbound UDP dport 8001 (was-sw01 → backbone → mia-sw01 → tunnel → DNAT)
+echo "--- Test 4: ip_echo UDP reachability (inbound UDP probe) ---"
+result=$(run_test relay-test-ip-echo.py 34.83.231.102 "$GOSSIP_PORT")
+if echo "$result" | grep -q "^OK inbound UDP"; then
+  pass "ip_echo UDP reachability: $result"
+elif echo "$result" | grep -q "^OK"; then
+  # Partial success — TCP worked but no UDP probes arrived
+  fail "ip_echo partial — no inbound UDP: $result"
+else
+  fail "ip_echo: $result"
+fi
+echo ""
+
 # Summary
 echo "=== Results: $PASS passed, $FAIL failed ==="
 if [[ $FAIL -gt 0 ]]; then