Add intern-network outside-isolation tests (veth + tap+relay variants)

A container joined only to an intern network gets no default route
(network_join.cpp), so pinging a real outside address (8.8.8.8) must
fail outright, not merely succeed slower than an extern join would.
Verified end-to-end as root: both variants correctly report
"Network unreachable" and the tests assert a RESULT= line was seen
(the command actually ran) that isn't RESULT=0.

tests/integration/test_network_join_scenarios.cpp

@@ -300,6 +300,67 @@ TEST_CASE("network join: two intern peers can ping each other by IP (veth)", "[i
     CHECK(found_success);
 }
 
+TEST_CASE("network join: intern network has no route to the outside (veth)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-intern-isolation-veth", NetworkKind::intern, /*veth=*/true);
+    REQUIRE(network.created());
+
+    // 8.8.8.8 is real, well-known and reachable outside this project's own
+    // sandbox (already confirmed by direct testing elsewhere this session,
+    // and by network_bridge.h's own extern-uplink verification) -- an
+    // intern network gets no default route at all (network_join.cpp), so
+    // this must fail, not merely time out slower than an extern join would.
+    auto output = run_networked(*image, {network.name()},
+                                 {"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
+    auto lines = extract_marked_lines(output);
+    bool found_result = false;
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line.rfind("RESULT=", 0) == 0) {
+            found_result = true;
+            found_success = (line == "RESULT=0");
+        }
+    }
+    CHECK(found_result);
+    CHECK_FALSE(found_success);
+}
+
+TEST_CASE("network join: intern network has no route to the outside (tap+relay)", "[integration][root][net]") {
+    if (geteuid() != 0) {
+        SKIP("requires root");
+    }
+    auto image = find_busybox_fixture();
+    if (!image) {
+        SKIP("no busybox fixture (images/busybox.tar) -- see tests/setup-tests.py");
+    }
+
+    ScratchXdgDirs scratch;
+    TestNetwork network("selftest-intern-isolation-tap", NetworkKind::intern, /*veth=*/false);
+    REQUIRE(network.created());
+
+    auto output = run_networked(*image, {network.name()},
+                                 {"sh", "-c", wait_for_eth0_then("ping -c 2 -W 2 8.8.8.8; echo RESULT=$?")});
+    auto lines = extract_marked_lines(output);
+    bool found_result = false;
+    bool found_success = false;
+    for (const auto& line : lines) {
+        if (line.rfind("RESULT=", 0) == 0) {
+            found_result = true;
+            found_success = (line == "RESULT=0");
+        }
+    }
+    CHECK(found_result);
+    CHECK_FALSE(found_success);
+}
+
 TEST_CASE("network join: two intern peers can ping each other by IP (tap+relay)", "[integration][root][net]") {
     if (geteuid() != 0) {
         SKIP("requires root");