feat(ec2): instance-networks introspection endpoint + SDKs + docs (#1745 phase 5)

[vieiralucas]

Summary

Phase 5 (final) of EC2 real network isolation (#1745). Stacked on #1757 (phase 4); base retargets as the stack merges.

Adds a debugging surface for "why can't X reach Y" and documents the whole #1745 networking story everywhere.

• Server: GET /_fakecloud/ec2/instance-networks returns, per instance, the Docker/Podman network or k8s NetworkPolicy backing it, its container IP, the isolationBackend (docker/podman/kubernetes/none), the securityGroupEnforcement mechanism (nftables/networkpolicy/disabled), and whether enforcement is enforcementActive vs degraded. Backed by a new Ec2Runtime::network_isolation_summary.
• SDKs: get_instance_networks / getInstanceNetworks added to all six (Rust/Go/Python/TS/Java/PHP) with the Ec2InstanceNetwork(s) types.
• Docs: introspection.md gains an EC2 section (both endpoints); ec2.md gains a Network isolation section (default VPC, per-subnet L3, nftables SG enforcement, k8s NetworkPolicy, compose interop, the NET_ADMIN requirement) and its now-stale "security groups not enforced" limitation is corrected; README + llms.txt + llms-full.txt updated; every SDK README + SDK doc page gains an EC2 section documenting both introspection methods.

Test plan

• crates/fakecloud-e2e/tests/sdk.rs::sdk_ec2_get_instance_networks — asserts the endpoint reports the resolved default VPC/subnet and a valid isolation-backend + enforcement mode (passes locally).
• cargo clippy -p fakecloud-ec2 -p fakecloud-sdk -p fakecloud --all-targets -- -D warnings, cargo fmt --all --check, bash scripts/check-doc-counts.sh all clean.
• Go SDK go build ./... + Python ast.parse clean; TS/PHP validated by their CI lint jobs.

---

Summary by cubic

Adds EC2 instance-network introspection to help debug “why can’t X reach Y”, and documents real network isolation and security‑group enforcement. Final phase of #1745.

• New Features

  • Server: GET /_fakecloud/ec2/instance-networks returns, per instance, the backing network (Docker/Podman network or k8s NetworkPolicy), container IP, isolationBackend (docker/podman/kubernetes/none), securityGroupEnforcement (nftables/networkpolicy/disabled), and enforcementActive.
  • Runtime: adds a summary of isolation/enforcement to drive the endpoint.
  • SDKs: get_instance_networks / getInstanceNetworks added to Rust, Go, Python, TypeScript, Java, and PHP.
  • Tests: new e2e asserts default VPC/subnet resolution and valid backend/enforcement.

• Docs

  • Introspection docs: new EC2 section covering both endpoints.
  • EC2 service docs: new “Network isolation” section (default VPC, per-subnet L3, nftables SG/NACL enforcement, k8s NetworkPolicy, Compose interop, CAP_NET_ADMIN/nft requirement); corrected the outdated “security groups not enforced” note.
  • Updated SDK READMEs and site snippets to include the new endpoint.

^{Written for commit 168cf9f. Summary will update on new commits.}