Add extern-network peer IP ping tests (veth + tap+relay variants)

Same shape as the intern-network peer-ping pair, on an extern network
instead: confirms same-bridge peer reachability still works once the
extern uplink (network_bridge.cpp's ensure_uplink_provisioned()) is also
provisioned alongside the bridge. Verified end-to-end as root, both
veth and tap+relay variants.

tests/integration/test_network_join_scenarios.cpp

@@ -300,6 +300,76 @@ TEST_CASE("network join: two intern peers can ping each other by IP (veth)", "[i
     CHECK(found_success);
 }
 
+TEST_CASE("network join: two extern peers can ping each other by IP (veth)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-extern-ping-veth", NetworkKind::extern_, /*veth=*/true);
+    REQUIRE(network.created());
+
+    auto subnet = test_network_subnet(network.name());
+    REQUIRE(subnet.has_value());
+    auto peer_a_ip = ipv4_host_address(*subnet, 2);
+    REQUIRE(peer_a_ip.has_value());
+    std::string peer_a_addr = peer_a_ip->substr(0, peer_a_ip->find('/'));
+
+    BackgroundPeer peer_a(*image, {network.name()}, std::nullopt, 20);
+    REQUIRE(peer_a.ready());
+
+    auto output = run_networked(
+        *image, {network.name()},
+        {"sh", "-c", wait_for_eth0_then(fmt::format("ping -c 2 -W 2 {}; echo RESULT=$?", peer_a_addr))});
+    auto lines = extract_marked_lines(output);
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line == "RESULT=0") {
+            found_success = true;
+        }
+    }
+    CHECK(found_success);
+}
+
+TEST_CASE("network join: two extern peers can ping each other by IP (tap+relay)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-extern-ping-tap", NetworkKind::extern_, /*veth=*/false);
+    REQUIRE(network.created());
+
+    auto subnet = test_network_subnet(network.name());
+    REQUIRE(subnet.has_value());
+    auto peer_a_ip = ipv4_host_address(*subnet, 2);
+    REQUIRE(peer_a_ip.has_value());
+    std::string peer_a_addr = peer_a_ip->substr(0, peer_a_ip->find('/'));
+
+    BackgroundPeer peer_a(*image, {network.name()}, std::nullopt, 20);
+    REQUIRE(peer_a.ready());
+
+    auto output = run_networked(
+        *image, {network.name()},
+        {"sh", "-c", wait_for_eth0_then(fmt::format("ping -c 2 -W 2 {}; echo RESULT=$?", peer_a_addr))});
+    auto lines = extract_marked_lines(output);
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line == "RESULT=0") {
+            found_success = true;
+        }
+    }
+    CHECK(found_success);
+}
+
 TEST_CASE("network join: intern network has no route to the outside (veth)", "[integration][root][net]") {
     if (geteuid() != 0) {
         SKIP("requires root");