Setting up G1 network sandbox + traffic-interception bridge for Hamza's trial

[dimos-bot]

Synced from DIM-1382

[dimos-bot]

Krishna (via Linear):
Set up a network sandbox to intercept and analyze the Unitree G1's telemetry for Hamza's security audit.

• Sandboxed the G1 — disabled WiFi/Tailscale on the robot (persistent), so its only network path is a wired link to a bridge laptop; no direct WAN access.
• Built the bridge laptop (company Alienware) — static IP 192.168.123.1, IP forwarding, and iptables rules that log + block all the robot's phone-home attempts while a tcpdump capture records its traffic.
• Verified the sandbox — confirmed the robot's outbound attempts (DNS to 1.1.1.1 / 8.8.8.8) are blocked and logged.
• Recon — mapped exposed services on both onboard computers (.164 dev PC + .161 control board): OTA update service, NoMachine remote desktop, unauth Tornado web UI, unauth DDS bus, rpcbind. Documented in g1_logs/G1_RECON_FINDINGS.md.
• Remote access — created a scoped hamza account on the bridge (SSH key + sudo) and shared the node over Tailscale; Hamza can now reach the bridge and the robot (via jump host) to run his analysis.
  ‌‌‌