Boot a minimal Alpine Linux guest in QEMU with iptables, ss-redir, and
ss-nat to verify the full transparent proxy chain: iptables REDIRECT →
ss-redir → ss-server (host) → internet. The host-built ss-redir binary
and its shared library dependencies are copied into the Alpine rootfs,
avoiding static linking issues. Uses QEMU user-mode networking with KVM
acceleration when available. Linux-only CI step with 8-minute timeout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
