make smoke-docker builds the image, stands up a stub upstream + the container on a shared network, and asserts forward+prefix-strip, upstream-header cleared, 421 on missing header, and 403 + reject sentinel on allowlist miss. Self- contained (no tailnet), idempotent, local-only (Docker) like cargo-check.