fix(#2363): open UDP 67 on the bridge — host firewall dropped DHCP requests

docs/network.md

@@ -66,12 +66,16 @@ agent containers.
 
 ## Firewall posture
 
-`networking.firewall.interfaces.<bridge>.allowedUDPPorts = [ 53 ]`
+`networking.firewall.interfaces.<bridge>.allowedUDPPorts = [ 53 67 ]`
 `networking.firewall.interfaces.<bridge>.allowedTCPPorts = [ 53 80 443 ]`
 
 - Port 53 opens the resolver on the bridge interface only. Other
   interfaces stay closed. The hive resolver isn't an external-facing
   service.
+- Port 67 (UDP) admits DHCP requests to the dnsmasq pool. dnsmasq
+  receives DHCP via a regular UDP socket (it does not use a
+  netfilter-bypassing raw socket), so the hole is mandatory — without
+  it containers never get a lease and fall back to 169.254.x.x.
 - Ports 80 and 443 let isolated agents reach nginx (gateway
   container, shared host netns) for the forge sub-domain, per-agent
   UI proxies, and any other HTTP services.