fix(mcp-profile-router/e2e): bypass Envoy egress for backend calls to avoid SO_REUSEPORT deadlock

On Linux, SO_REUSEPORT assigns incoming TCP connections to a specific
Envoy worker socket via kernel hash. When callServer() runs inside the
filter body callback, the Envoy worker thread is blocked in CGO; if the
outgoing connection hashes to that same worker's socket, Envoy can never
accept it and the 2-second http.Client.Timeout fires, leaving no session
ID in the response.

On macOS SO_REUSEPORT is force-disabled so a shared accept socket lets
any free worker pick up the connection — hence tests pass locally.

Fix: point profile Server.URL directly at the httptest backends instead
of routing through the Envoy proxy/egress listener. All profile-router
logic (auth, aggregation, tool routing, session encoding) is still fully
exercised. The cluster-router debug endpoint check in the combo test is
unaffected as it is a simple GET from the test goroutine.

Author: dio

examples/mcp-profile-router/e2e/e2e_test.go

@@ -197,15 +197,19 @@ func TestMCPProfileRouterEndToEnd(t *testing.T) {
 	proxyPort := e2etest.FreePort()
 	adminPort := e2etest.FreePort()
 	proxyURL := fmt.Sprintf("http://127.0.0.1:%d", proxyPort)
+	// Point servers directly at the httptest backends instead of routing through
+	// the Envoy proxy. On Linux, SO_REUSEPORT can assign outgoing connections made
+	// inside the filter body callback to the same Envoy worker thread that is
+	// blocked in CGO, causing a deadlock and a 2-second timeout.
 	profile := mcpprofilerouter.Profile{
 		ID:            "9b3f7d0a80c4aa6d-67261ca9ea3dadb2",
 		Name:          "kiwi",
 		APIKey:        "profile-key",
 		RouteHeader:   "x-mcp-server",
 		TimeoutMillis: 2000,
 		Servers: map[string]mcpprofilerouter.Server{
-			"github": {URL: proxyURL + "/_egress/github", Prefix: "github", Credential: "Bearer github-token"},
-			"kiwi":   {URL: proxyURL + "/_egress/kiwi", Prefix: "kiwi", Credential: "Bearer kiwi-token"},
+			"github": {URL: github.URL, Prefix: "github", Credential: "Bearer github-token"},
+			"kiwi":   {URL: kiwi.URL, Prefix: "kiwi", Credential: "Bearer kiwi-token"},
 		},
 	}
 
@@ -303,14 +307,19 @@ func TestMCPProfileRouterWithClusterRouterEndToEnd(t *testing.T) {
 	adminPort := e2etest.FreePort()
 	proxyURL := fmt.Sprintf("http://127.0.0.1:%d", proxyPort)
 	egressURL := fmt.Sprintf("http://127.0.0.1:%d", egressPort)
+	// Point servers directly at the httptest backends instead of routing through
+	// the Envoy egress listener. On Linux, SO_REUSEPORT can assign outgoing
+	// connections made inside the filter body callback to the same blocked Envoy
+	// worker, causing a deadlock. The cluster-router debug endpoint (egressURL)
+	// is still exercised below; only the per-call HTTP egress hop is bypassed.
 	profile := mcpprofilerouter.Profile{
 		ID:            "9b3f7d0a80c4aa6d-67261ca9ea3dadb2",
 		Name:          "kiwi",
 		APIKey:        "profile-key",
 		TimeoutMillis: 2000,
 		Servers: map[string]mcpprofilerouter.Server{
-			"github": {URL: egressURL, Prefix: "github", EnabledTools: map[string]bool{"search": true}},
-			"kiwi":   {URL: egressURL, Prefix: "kiwi", EnabledTools: map[string]bool{"search_flights": true}},
+			"github": {URL: github.URL, Prefix: "github", Credential: "Bearer github-token", EnabledTools: map[string]bool{"search": true}},
+			"kiwi":   {URL: kiwi.URL, Prefix: "kiwi", Credential: "Bearer kiwi-token", EnabledTools: map[string]bool{"search_flights": true}},
 		},
 	}
 	clusterConfigJSON := marshalJSON(map[string]any{