Fix two sidecar container references that skipped the per-run suffix

The isolation loop and the failure-log dump both built container names
without the run suffix, so under a suffixed run they addressed containers
that do not exist.

The consequence was worse than the visible failure. Two of the three
checks in that loop assert a ping FAILS, and a ping into a non-existent
container fails for the wrong reason - so both passed vacuously, and the
security assertion the loop exists for was silently a no-op. Only the
third check, which expects a ping to succeed, noticed anything was wrong.

Add a guard that fails loudly when the container is absent, so a future
naming slip cannot quietly turn these back into no-ops rather than
surfacing as one confusing failure among two false passes.

These sites were missed because the suite passes when run by hand: with no
suffix set the unsuffixed names are correct, and the defect only appears
under the automation that sets one. Verified this time with the suffix
set, which is the condition that matters: 18 of 18, container names
resolving to real containers.

testing/sidecar/scripts/test-sidecar.sh

@@ -256,7 +256,14 @@ fi
 log "Verifying network isolation on app containers..."
 
 for node in a b c; do
-    container="sidecar-${node}-app-1"
+    container="sidecar-${node}${FIPS_CI_NAME_SUFFIX:-}-app-1"
+    # Fail loudly if the container is missing. Without this the two isolation
+    # assertions below pass vacuously: they assert a ping FAILS, and a ping into
+    # a non-existent container fails for the wrong reason. Only the loopback
+    # check, which expects success, would notice — so a naming slip here would
+    # silently turn the security assertions into no-ops.
+    docker inspect "$container" >/dev/null 2>&1 \
+        || { fail "$container does not exist — isolation assertions cannot be trusted"; continue; }
     # Pick a peer IP that isn't this node's own address
     case $node in
         a) peer_ip="$NODE_B_IP" ;;
@@ -296,7 +303,7 @@ if [ "$FAILED" -gt 0 ]; then
     log "Dumping logs for failed run..."
     for node in a b c; do
         echo "--- sidecar-${node} logs ---"
-        docker logs "sidecar-${node}-fips-1" 2>&1 | tail -30
+        docker logs "sidecar-${node}${FIPS_CI_NAME_SUFFIX:-}-fips-1" 2>&1 | tail -30
         echo ""
     done
     exit 1