fix(quic-interop): make smoke target work on Docker Desktop for Mac

Two coupled fixes that surface together when running the smoke target
outside the runner's privileged sim environment:

1. run_endpoint.sh now tolerates /setup.sh failures.

   The base image's /setup.sh manipulates routes for the runner's ns-3
   sim. Outside the runner (e.g., make smoke without --privileged), it
   fails with "netlink error: Operation not permitted" — and our
   set -euo pipefail bailed before launching the JVM. The setup is
   genuinely not needed for smoke; tolerate the failure and continue.

2. make smoke uses a private Docker bridge instead of --network host.

   --network host on Docker Desktop for Mac is *not* the Mac host's
   network — it's the LinuxKit VM's, and 127.0.0.1 isn't routed back
   to other Docker containers. A dedicated bridge with DNS-by-name
   works identically on Mac and Linux. Bonus: smoke-down target
   reliably tears down the env.

Inside the runner these changes are no-ops: the runner provides the
privileges /setup.sh needs, and uses its own compose network not
--network host.

https://claude.ai/code/session_01HcvfQq1ttPV9PkRoJb4nyT

quic/interop/run_endpoint.sh

@@ -1,13 +1,18 @@
 #!/usr/bin/env bash
 # quic-interop-runner endpoint entry point.
 #
-# The base image (martenseemann/quic-network-simulator-endpoint) sets up
-# routing in /setup.sh; we source it then dispatch to our JVM client based
-# on the ROLE env var pushed in by the runner.
-set -euo pipefail
+# The base image (martenseemann/quic-network-simulator-endpoint) provides
+# /setup.sh, which configures routing for the runner's ns-3 sim. We try
+# to source it but tolerate failure so smoke tests outside the runner
+# (without --privileged / the sim's network) still launch the JVM client.
+# Inside the runner, /setup.sh succeeds because the runner provides the
+# necessary capabilities.
+set -uo pipefail
 
 # shellcheck disable=SC1091
-source /setup.sh
+source /setup.sh 2>/dev/null || echo "(setup.sh skipped — running outside the runner sim)" >&2
+
+set -e
 
 case "${ROLE:-client}" in
     client)