test: add full nginx injection tests and runnable examples

[pawelchcki]

Add installer acceptance tests that verify real Nginx → Flask traces on a simulated Linux host and in ordinary Debian, Alpine, and single-node Docker Swarm workloads. The suite checks HTTP responses, decoded spans, parent relationships, environment settings, agent routing, sampling, disablement, reloads, injection failures, stable configuration, and global RUM opt-out.

The installer configures host or Docker injection. Workload containers and the Swarm service specify no runtime and contain no manual tracing setup. Published packages and checkout-built OCI packages share the same tests, including installed-module checksum verification for checkout artifacts.

Stable-config coverage follows the system-tests YAML schemas for local and managed files. It checks defaults, managed > environment > local precedence, targeting rules, tags, tracing disablement, and global RUM opt-out. The missing C++ tracing support and stable-config RUM opt-out are strict expected failures. An unexpected pass fails CI so the markers must be removed when support lands.

The single-node Swarm smoke test starts an ordinary Nginx service with one replica. It requires a loaded module, an unchanged HTML response with DD_RUM_ENABLED=false, and exactly one decoded nginx.request span. Artifacts record the node, service, task, container, process map, logs, and span before cleanup. Multi-node scheduling, overlay networking, routing mesh, rolling updates, rescheduling, and node failure remain outside this test.

This reuses the stable-config contract from system-tests. The Nginx-specific execution is separate coverage: installer injection, ordinary host and Docker services, module loading, HTTP responses, decoded spans, trace parenting, and RUM-disabled HTML with tracing still active.

Add architecture-matched GitLab jobs, diagnostic artifacts and JUnit, plus make test-injection and host/Docker example commands.

Validation:

• Repository lint and all 10 harness unit tests pass; 83 acceptance cases collect.
• Native ARM64 Orb runs exercised stable config with the published package across host, Debian Docker, and Alpine Docker. The tracing slice produced 18 strict xfails. The files were visible in each workload, and the injected Python backend consumed them, confirming the failures are specific to Nginx tracing support.
• The RUM opt-out slice produced 3 passes for DD_RUM_ENABLED=false in the environment and 6 strict xfails for the equivalent local and managed stable-config setting. Every case required an injected module, a real text/html response, and a valid Nginx span, so tracing remained active.
• The Swarm smoke test passed on native ARM64 with both the published package and a checkout-built OCI package. Each run saved the Swarm service/task IDs, unchanged HTML, loaded-module evidence, and the decoded nginx.request span.
• Both examples served requests, saved linked Nginx → Flask traces, and cleaned up successfully.
• Full native ARM64 Orb runs passed the implemented tracing coverage with both published and checkout-built packages. Each run saved verified Nginx → Flask trace pairs.
• The existing unittest runner discovers all 277 cases without importing pytest; a regression test covers that separation.
• The four injection jobs passed in pipeline 136708859: published and checkout-built packages on AMD64 and ARM64. That baseline predates the added Swarm smoke case; the current PR pipeline will run it in each injection job.

[datadog-prod-us1-5]

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 69.19% (-0.08%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6dab7ff | Docs | View more details | Give us feedback!}