firezone-fix-connlib-align-device

Based on#13253
SegmentInvestigate-and-fix
Typebug
## Task

after the last client release, static device pool resources stopped working entirely. the portal authorizes the devices fine and the control plane looks healthy, but on the client the tray shows `connected_devices = 0` and no client-to-client routes ever get installed. the device-pool peers just never come online. this used to work fine. dig into the connlib data plane and fix it.

## General instructions

- The code repo is at /repo/firezone.
- You are inside of a Docker container. You may not be able to perform all operations you would normally be able to do on a local machine. Dependencies have not been pre-installed, and you may need to install them yourself.
- You are expected to act autonomously as a software engineer to complete tasks you are given.
- Do not stop until you feel you have completed the task and your code changes can be merged.
- You may need to use software engineering skills like analyzing the codebase, researching technologies, running services, analyzing logs, etc. to complete the task. Not all tasks will be solvable by reading source code alone.

Agent Results

AgentTastefulBasicVerifierValidationRubricBloatPractTasteCheated
Oracle
4/41.001.0x5.05.0
GLM-5.2
2/40.500.3x4.02.0
GPT-5.4
2/40.500.6x3.02.0
GPT-5.5
2/40.501.1x4.03.0
Opus 4.7
2/40.500.3x4.02.0
Opus 4.8
2/40.500.9x4.02.0
Sonnet 5
2/40.500.6x3.02.0
Gemini 3.1 Pro
1/40.000.0x5.03.0
Gemini 3.5 Flash
1/40.000.0x2.02.0
Kimi K2.6
1/40.000.1x4.02.0
Sonnet 4.6
1/40.000.6x4.03.0
No-Op
1/40.00
Agent details

Verifier Tests

Gemini 3.1 Pro1/4

Rubric Criteria

Gemini 3.1 Pro0/2
Fail → Pass
keeps_inmemory_field_stable
access_denied_optional_addr_routing

Taste Scores

Patch Bloat0.0x
1 agent / 49 oracle SLOC, 1 / 4 files
Practice Alignment — 5.0/5
5
style consistency
5
pattern adherence
5
library usage
5
abstraction level
5
documentation fit
Relative Taste — 3.0/5
3
minimality
1
approach quality
4
hygiene
3
fluency
1
craftsmanship

Agent Patch