probe: the docker runner has no egress - diagnose which path is broken

The install-test never reached k3d. It hung in azure/setup-helm: the
latest-release lookup failed ('fetch failed') and the download from
get.helm.sh ran into a 6-minute request timeout, twice. The other runner
installed Helm in the same run in seconds, so this is specific to the
docker runner - and on 2026-09-14, BEFORE the rootful-DinD rebuild, that
same runner fetched k3d from raw.githubusercontent.com and pulled the k3s
images without trouble.

This round separates DNS, job-container egress and docker-daemon egress
so the answer is actionable rather than 'the network is broken'. Only
cyberchef this time; freesailarr proves nothing while nothing downloads.

.github/workflows/validate-charts.yml

@@ -288,8 +288,31 @@ jobs:
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@v7
+      - name: "PROBE egress from the job container (throwaway branch only)"
+        run: |
+          set +e
+          echo "### resolv.conf"; cat /etc/resolv.conf
+          echo "### DNS"
+          for h in get.helm.sh api.github.com raw.githubusercontent.com registry-1.docker.io ghcr.io; do
+            printf '%-28s ' "$h"; getent hosts "$h" || echo "DNS FAILED"
+          done
+          echo "### HTTPS from the JOB container"
+          for u in https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz https://api.github.com/ https://raw.githubusercontent.com/ https://registry-1.docker.io/v2/ https://ghcr.io/v2/; do
+            printf '%-62s ' "$u"
+            curl -sS -o /dev/null -m 20 -w 'http=%{http_code} dns=%{time_namelookup}s conn=%{time_connect}s total=%{time_total}s\n' "$u" || echo "CURL FAILED"
+          done
+          echo "### egress of the DOCKER DAEMON (separate network path)"
+          docker pull --quiet alpine:3.20 && echo "docker pull alpine OK" || echo "docker pull alpine FAILED"
+          docker pull --quiet ghcr.io/k3d-io/k3d-proxy:5.9.0 && echo "docker pull ghcr OK" || echo "docker pull ghcr FAILED"
+          echo "### cgroups (the thing that was fixed)"
+          docker info --format 'server={{.ServerVersion}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} storage={{.Driver}}'
+          docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
+          echo "### done - this step never fails on purpose"
+          exit 0
       - name: "Install Helm"
         uses: azure/setup-helm@v5
+        with:
+          version: v3.18.4
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key