ci / rust (push) Successful in 7m28s
Two scenarios: * broker_t2_attach_through_home_daemon: alpha + beta share perimeter "wg-test"; beta lists alpha in allow_inbound. Test attaches to beta's session via alpha's /api/attach/:id and verifies the PTY echoes back. * broker_rejects_when_target_doesnt_allow_inbound: same setup but beta's allow_inbound is empty; the broker WS handshake succeeds at alpha (which has no reason to refuse) but beta drops the pair JWT, so the proxied stream closes without any PTY bytes flowing. Extends maestro-e2e::Daemon with DaemonOptions and a spawn_at variant that fixes the bind address, so the daemon's advertised private_addr matches the port the broker will dial. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>