feat(sandbox): isolate actions with Firecracker

[Windsor Nguyễn (windsornguyen)]

Depends on #62.

What does this change?

This PR adds the local untrusted-v1 Firecracker executor. The build, test, and run commands accept --sandbox and execute admitted actions in new microVMs.

• The action key includes the sandbox profile, protocol, backend, and execution-bundle digest.
• The launcher verifies SHA-256-pinned Firecracker, jailer, kernel, root filesystem, and guest-agent inputs.
• The launcher assigns unique user IDs, group IDs, and cgroups. It accepts only the fixed two-vCPU and two-GiB profile.
• The guest uses a private tmpfs workspace, an explicit environment, declared inputs, bounded output streams, and declared outputs.
• The input archive is deterministic. Bessemer hashes input bytes again while it creates the archive.
• Bessemer validates the complete output archive before it imports an output.
• CI uses nested KVM to test execution, isolation, failure handling, cancellation, concurrency, and complete cleanup.
• The documentation defines the threat model, operator contract, and current limits.

The executor fails closed. It does not retry an incompatible or failed action on the host.

This profile supports only x86_64 Linux with KVM. It rejects networking, inherited host environments, persistent workers, output reuse, local resources, snapshots, VM reuse, secrets, custom devices, and remote execution.

How was it tested?

• python3 test.py --ci --git --lint-rust-only.
• python3 test.py --ci --git --rustdoc-only.
• python3 test.py --git --test-only bsmr_sandbox bsmr_execute_impl bsmr_client bsmr_server passed 154 focused tests before the final boundary cases.
• cargo test -p bsmr_execute_impl executors::firecracker::tests passed 19 tests.
• Native Linux cargo test --locked -p bsmr_sandbox covered the launcher, guest, transport, fixed resources, and cleanup.
• cargo clippy -p bsmr_sandbox --target x86_64-unknown-linux-gnu --all-targets -- -D warnings.
• cargo build --locked --bin bsmr.
• pnpm run ci check passed 44 tests and the generation, provenance, license, and workflow-security checks.
• target/debug/bsmr docs markdown-help-doc all matches docs/reference/cli.md.
• uv run --with-requirements docs/requirements.txt mkdocs build --strict -f mkdocs.yml.
• git diff --check chore/centralize-upstream-attribution...HEAD.

The required Rust / Firecracker sandbox job is the real nested-KVM execution gate.

• CLA/Vouch check passes, or this PR only updates VOUCHED.td.

Reviewers

• Domain: Tsion Kergo (@tsiongk)
• Readability: annyzhou