Add Arrcus ArcOS as a containerlab device (best-effort)

[roc-ops]

Add Arrcus ArcOS as a containerlab device (best-effort)

This PR adds Arrcus ArcOS as a netlab device. ArcOS runs as a native
containerlab node (kind: arrcus_arcos) — there is no vrnetlab packaging and no
Vagrant box. Support level is best-effort.

Connection and validation model — no core change

ArcOS ships the official arrcus.arcos Ansible collection (the project-recommended
network_cli model), but every published version (2.0.13–2.0.18) hangs against the
tested container image: its cliconf/terminal plugins issue a config terminal /
arcos_cli mode-switch that this build's confd_cli rejects. Configuration is
therefore deployed over Ansible's built-in docker connection plugin (docker exec running confd_cli load merge / commit) — the same pattern
sonic_clab already uses. The device keeps a commented-out network_cli block to
switch to once a working collection version ships.

netlab validate reads device state over the same docker-exec path
(show <path> | display json | confd_cli, parsed as OpenConfig JSON by
netsim/validate/**/arcos.py). This is netlab's standard device-side show-command
validation — no ansible validation action and no change to any core file.
netsim/cli/connect.py, netsim/cli/validate.py, netsim/augment/validate.py,
netsim/attributes.yml, netsim/templates/provider/clab/clab.j2, and tests.py are
untouched (byte-identical to dev). This is a pure device addition.

The tested image boots with SSH/NETCONF/gNMI disabled and refuses to enable
interfaces until the factory admin-user password is changed; both are handled with
the native netlab_start_exec group_var (containerlab's post-start exec:) — no
custom deploy code.

Module coverage

initial, ospf (v2/v3), bgp, isis, vrf (+ospf/isis/bgp), vlan, lag,
gateway (VRRP), dhcp/relay, bfd, routing (static/prefix-set/policy),
mpls (LDP), sr (SR-MPLS via IS-IS), srv6, vxlan, and evpn (L2VNI).

Honest limitations are documented in docs/caveats.md (e.g. EVPN symmetric IRB/L3VNI,
VRF route-target leaking, and OSPFv2 area authentication are genuinely unsupported and
not declared; MPLS/SR/SRv6 bring up the control plane only on the native container;
DHCP relay renders but its datapath is not exercised on a clab-only host, so ArcOS is
omitted from the DHCP support table).

Verification

Verified on real ArcOS containers (image arcos:8.2.1A.P2), containerlab provider,
against this branch:

Test	Result
02-ospf — OSPFv2 adjacency	2/2 PASS (FULL both directions)
03-bgp — eBGP session + prefixes	4/4 PASS (ESTABLISHED + peer loopbacks in RIB)
04-isis — IS-IS adjacency + reachability	4/4 PASS
05-routing — static route	2/2 PASS; kernel FIB (proto static) installed and loopback-to-loopback ping 0% loss
combined ospf+bfd+vrf	deploys clean; per-VRF OSPF reaches FULL; BFD session UP both directions

netlab initial commits every module cleanly (idempotent on re-run) and netlab collect retrieves the running configuration. The rendered CLI and the show/get paths
used by the validators were cross-checked against the vendor ArcOS S8.5.1A CLI
reference.

Files

• Device: netsim/devices/arcos.yml
• Deploy/collect tasks: netsim/ansible/tasks/{deploy-config,fetch-config}/arcos.yml
• Templates: netsim/ansible/templates/*/arcos.j2 (16 modules)
• Validators: netsim/validate/arcos.py + netsim/validate/{ospf,bgp,isis,routing}/arcos.py
  (adds the netsim/validate/routing/ package)
• Integration tests: tests/integration/platform/arcos/
• Docs: docs/platforms.md, docs/caveats.md, docs/install/arcos.md,
  docs/release/26.07.md

This PR also removes netsim/templates/provider/libvirt/arcos-domain.j2, an orphaned
libvirt domain template from a much older, never-completed ArcOS device (no
netsim/devices/arcos.yml ever existed for it); the new device is containerlab-only.

ArcOS is a commercial NOS, so users supply their own container image (as with
sros/dellos10/arubacx).

[ipspace]

Before going into the details: I think you should change the configuration deployment method.

It looks like you're generating a bash script that takes a config and runs confd_cli to deploy it. If that's the case, you don't need Ansible -- netlab can generate bash scripts, map them to the container, and then execute them inside the container. You can also map templates into container files to create scripts (like what you have in the shell command) that are then executed.

FRR uses the "run a bash script" approach together with "let's add a shebang when needed" trick. cRPD maps a template to a container script to generate the deployment script (/config/netlab/netlab-config.sh).

More @ https://netlab.tools/dev/config/deploy/#linux-configuration-scripts

[ipspace]

Next major item: we don't have per-platform integration tests (what you added in tests/integration/platform). Please remove those.

The device implementations are tested with regular integration tests (see https://netlab.tools/dev/integration-tests/). If you want to test the validation plugins, you'll find some tests in tests/platform-integration/validate.

[ipspace]

One more generic comment -- I strongly recommend you use the same indentation trick we use in other Jinja2 templates to make the templates more readable. Unfortunately, that's the best I could come up with, and it looks like some vendors picked it up as well.

For example:

{% for x %}
{%   if y is defined %}
{%   endif %}
{% endfor %}

[roc-ops]

Thanks for the review, Ivan — all three addressed.

1. Deploy method. Switched the ArcOS device from the Ansible deploy task to netlab's native container-script (sh) config mode, following cRPD: a wrapper netsim/templates/provider/clab/arcos/netlab-config.j2 is mapped to /config/netlab/netlab-config.sh, and each module is rendered with a #!/config/netlab/netlab-config.sh shebang and executed via docker exec, which hands the rendered config to the wrapper to load through confd_cli (load merge/commit). netsim/ansible/tasks/deploy-config/arcos.yml is removed; no Ansible is involved in deployment. I kept the docker connection only for the validation/collect path (the tested build has SSH/NETCONF/gNMI disabled). Re-verified on a real arcos:8.2.1A.P2 container: netlab up deploys via the mapped script and OSPF reaches FULL / iBGP ESTABLISHED.

2. Platform tests. Removed tests/integration/platform/arcos/ entirely — the device is exercised by the regular integration tests.

3. Jinja2 indentation. Applied the readable nested-indentation convention (tag keyword indented with the block) across the ArcOS templates.

Rebased onto current dev.