Add a bounded network diagnostics recipe for ephemeral runners

[garysassano]

An ephemeral runner can disappear before a transient package-download slowdown is investigated. Aggregate network-byte metrics and a later roc logs --full archive cannot reconstruct destination timings or TCP counters that were never captured. This adds a Linux workflow recipe and a standalone standard-library Python probe to capture that evidence during the job.

Closes runs-on/runs-on#542

Changes

• Read local counters only when no URLs are supplied.
• Support optional public HTTPS transfers with time, size, and redirect limits, emitting an allowlist of curl timing fields.
• Exclude response bodies, full URLs, environment dumps, curl stderr, and credential-bearing URLs from the output.
• Explain host/container observations, cache API failures, remote-service delays, and evidence that still needs a live authorized session.
• Test output filtering, URL validation, bounded invocation, and timeout handling.

Scope

This addresses the requested workflow-probe guidance. It does not establish an egress defect, add automatic agent telemetry or alerts, or reproduce the original v2.12.1-rc.4 incident on v3. No CLI commands, AWS interfaces, or flags change.

Validation

• Python unit tests and Ruff checks/format pass.
• A local counters-only smoke test succeeds.
• A failed connection to the loopback interface produces valid JSONL.
• Current public CLI documentation and source were checked.

No public-network benchmark or AWS calls were made. The public checkout does not contain the monorepo ../docs/PROJECT_CONTEXT.md referenced by AGENTS.md.