KVM battery: the egress leg runs before monerod's container exists, and misreports it as 'lacks curl'

[VijitSingh97]

Seen on every provision-phase run of the current battery (three runs, 2026-08-04):

✗ monerod lacks curl — cannot assert the Tor-only egress drop (the #855 backstop is unverified)

The precheck is podman exec monerod sh -c 'command -v curl' (tests/os/run.sh, the egress backstop leg). On the live bench the same image's monerod has curl and the same dials pass — so the container almost certainly does not exist yet when the leg runs: the earlier container assertion in the same phase prints podman: tor caddy docker-control docker-proxy dashboard (no monerod — its baked archive is the largest and the loader + up are still bringing it up), while the later commit-gate leg happily runs podman stop monerod. podman exec against a missing container fails exactly like a missing binary, and the message pins the wrong cause.

Two fixes in one:

• wait for the monerod container (bounded, same style as the phase's other waits) before the precheck;
• split the failure message: "monerod container not present" vs "curl missing in the image" are different diagnoses with different fixes.

Until then the #855/#858 egress assertions are silently unexercised in the battery — they pass live on the bench, but the battery is the release gate that is supposed to prove them per run.