feat(sandbox): restore actions from pristine snapshots

[Windsor Nguyễn (windsornguyen)]

Closes #66. Depends on #65.

What does this change?

This PR restores each untrusted-v1 action from a digest-pinned Firecracker snapshot. Fresh boot remains an explicit correctness oracle.

The bundle builder boots the trusted guest to a pre-action vsock barrier. It pauses the VM and writes immutable state and memory artifacts.

The launcher verifies the bundle and exact host fingerprint. It stores immutable VM artifacts by SHA-256 and hard-links them into a unique action jail. Firecracker shares unchanged memory through the page cache and uses private copy-on-write pages for changes. Bessemer destroys each clone after one action.

Protocol version 2 authenticates action and input descriptors with SHA-256 across the privileged boundary. It bounds each descriptor before attachment and copies data with Linux sendfile. The restored guest receives fresh virtio-rng entropy before it reads action state.

This PR does not add a network device, host checkout, fallback executor, userfaultfd pager, asynchronous block engine, or guest-visible RDMA path.

CI runs the same conformance tests against fresh boot and snapshot restore. It records all 30 environment-start and round-trip samples. Snapshot restore must improve p50 and p95 environment-start time by at least four times. The benchmark artifact records the environment digest and host fingerprint.

Review focus

• Verify the pristine snapshot barrier.
• Verify host compatibility and descriptor authentication.
• Verify action cleanup and the same-filesystem hard-link requirement.
• Verify that the benchmark also reports complete round-trip time.

How was it tested?

• container exec bsmr-snapshot-linux sh -c 'cd /work && cargo clippy --locked -p bsmr_sandbox --all-targets -- -D warnings && cargo test --locked -p bsmr_sandbox'.
• cargo test --locked -p bsmr_execute_impl firecracker --lib passed 19 tests.
• pnpm run ci check passed 47 tests.
• pnpm run ci 'check generated'.
• pnpm run ci 'check license'.
• pnpm run ci 'check security'.

The trusted x86_64 CI lane owns the nested-KVM conformance and performance result. Local macOS tests do not provide KVM evidence.

• CLA/Vouch check passes, or this PR only updates VOUCHED.td.

Reviewers

• Domain: Tsion Kergo (@tsiongk)
• Readability: annyzhou