egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines

nix/host-modules/hive-egress.nix

@@ -360,7 +360,8 @@ in
       - `log` (the default): the same lines and counters, and the frame goes
         through. For finding out why a legitimate container is refused on a
         live hive. It is the default because the lease set does not yet survive
-        a host suspend/resume; `drop` returns once a resume test proves it.
+        a host suspend/resume; `drop` returns once a resume test proves it and the
+        `egress-lease: … skipped (stale)` lines confirm the renewal fix on a live hive.
 
       With `log`, the identity squid takes from the source of an intercepted
       flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.

nix/vm-tests/hive-egress-antispoof.nix

@@ -221,9 +221,9 @@ pkgs.testers.runNixOSTest {
     host.wait_for_unit("multi-user.target")
     host.wait_for_unit("dnsmasq.service")
     host.wait_for_unit("hive-egress.service")
-    # The default verdict, loaded before either container exists: the first
-    # lease of each container below is taken with the drop rule in place.
-    assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "the default is drop"
+    # `drop` is set explicitly on the host above, loaded before either container
+    # exists: the first lease of each container below is taken with it in place.
+    assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "antiSpoof = drop is loaded"
     for name in ("a", "b"):
         host.wait_for_unit(f"container@{name}.service")
         host.wait_until_succeeds(