[feat] Add bridged networking with offline startup and adapter recovery

[Fail-Safe]

What changes

Adds a Networking sheet to the launcher with Shared connection (NAT), the default, and Bridged networking through a selected host adapter. Bridged mode gives the VM its own LAN address while keeping QEMU unprivileged; a bundled, signed networking helper receives one-time macOS approval.

The selected adapter can be absent at launch: Omarchy starts offline, retains the selection, and connects when it returns. Dock or Ethernet disconnects recreate the bridge attachment while preserving the VM's connection. The launcher uses neutral mode labels and an informational offline-start notice.

Saved NAT port-forwarding rules remain stored but inactive while bridged. LAN SSH access is a separate opt-in. Wi-Fi compatibility handling is disclosed in the sheet and restored when the session ends. Only one bridged session is allowed at a time.

Implementation

• Bind privileged requests to the signed bundled client and active user's application/launcher process chain; validate staged helper payloads before execution.
• Monitor adapter link state and interface identity, debounce attachment, and retry failed attachment. Bound packet buffering and framework lifecycle waits.
• Deliver carrier changes through the VM's private QMP connection, with process identity checks.
• Preserve helper repair, stale-payload detection, owner-exit cleanup, and Wi-Fi setting restoration.
• Vendor the socket_vmnet server with its Apache-2.0 license and document local modifications.

Validation

Manual tests on the local integration build containing this networking implementation:

• Wi-Fi bridging: connectivity, DNS, and Wi-Fi off/on recovery.
• Thunderbolt dock Ethernet: repeated whole-dock and Ethernet-cable disconnect/reconnect.
• USB-C Ethernet: repeated adapter and cable disconnect/reconnect, return after approximately 12 hours absent, and host sleep/wake.
• Offline launch with the selected adapter absent, first attachment without restarting, subsequent reconnection, and normal shutdown while disconnected.
• Launcher mode labels, available/unavailable adapter states, and offline-start notice.

Automated validation on this isolated upstream branch: full make test (261 Swift tests plus guest, shell, C, and Python suites), including native networking policy, helper framing/recovery, stale payload, and launcher contract tests; signed app build and bundled Mach-O compatibility checks. The QEMU runtime was built from the current pinned upstream scripts for macOS 15. The app build reuses the existing factory guest artifact; it is not a fresh factory-image build.

Remaining release qualification

Developer ID signing/notarization and helper registration upgrade/relocation need release-environment qualification. One unattended Thunderbolt test showed a temporary latency excursion that recovered; its cause remains unestablished. A separate user-mode NAT ICMP reply-association issue is outside this PR; no NAT runtime fix is included.

Implementation limitations for review: helper connection verification is synchronous and can pause the launcher while waiting; the carrier watcher is cleaned up with the VM but is not automatically restarted after an unexpected exit.

UI screenshots

Screenshots from the tested local integration build. Surrounding launcher settings may differ from upstream; these illustrate the networking controls and offline-start notice.

Shared connection (NAT)

Shared connection (NAT) remains the default and uses the Mac’s connection.

Bridged networking

Bridged mode provides adapter selection and a separate opt-in for LAN SSH access. Wi-Fi compatibility handling is explained before saving.

Offline startup

An unavailable adapter does not block startup. Omarchy starts offline and connects when the selected adapter returns.