TLS-wrapped Frida transport for cross-host setups

Summary

When beetroot frida connects to the container over a host port, a network observer between the host CLI and the container can see Frida's D-Bus handshake. This does not matter for the default loopback setup (the kernel is ours; loopback traffic isn't inspectable from a malicious app inside the container), but it does matter for cross-host setups where the CLI and the container run on different machines.

Idea

Offer a TLS-wrapped transport for the beetroot frida <-> container connection so the handshake isn't observable on the wire in cross-host deployments.

Notes

Explicitly out of scope through v0.6 — documented as a "v0.6 might" item. Lower priority than the on-device fingerprints; only relevant once cross-host usage is a supported topology.

Source: docs/design/stealth-posture.md §8 "Out of scope" (Frida network-level fingerprints).

Start by reading docs/design/stealth-posture.md §8, especially the note on Frida network-level fingerprints and the v0.6 scope. Determine the supported cross-host topology and how the beetroot frida-to-container connection is currently established. Done means there is a decided, scoped approach for offering TLS-wrapped transport without changing the default loopback setup.