chore(fleet): sync operator memory, hatch menu dialogs, and watchdog alerts

bin/netvm-enter-inner.sh

@@ -4,8 +4,13 @@ set -euo pipefail
 # /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
 # in the netns). Replace with a real file (private mount ns) so bwrap
 # children see the fix too: bwrap's --ro-bind /etc is non-recursive and
-# cannot bind over a dangling symlink.
-rm -f /etc/resolv.conf
-cp "$NETVM_RESOLV" /etc/resolv.conf
+mount --make-rprivate / 2>/dev/null || true
+if [ -L /etc/resolv.conf ] || ! cmp -s "$NETVM_RESOLV" /etc/resolv.conf 2>/dev/null; then
+  TMP="/etc/resolv.conf.netvm.$$"
+  if cp -f "$NETVM_RESOLV" "$TMP" 2>/dev/null; then
+    mv -f "$TMP" /etc/resolv.conf 2>/dev/null || rm -f "$TMP" 2>/dev/null || true
+  fi
+fi
+
 exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
   env HOME="$NETVM_HOME" "$@"