nvx-rs: turn the wire-format golden bytes into versioned conformance vectors #727

Related: #545, #581, #623.

Goal

Keep the golden byte tests of the wire formats, which are the only check against implementations that share no code with nvx-rs, and make them versioned conformance vectors that the protocol documents own, rather than output of the former Python client.

Background

• src/protocol/tests.rs pins NVXS outer records, NVXC frames, and EXEC, MAPS, and features payloads as literal bytes, produced with Python's struct module. The host, the guest agent, and the fake OpenVMM share one codec, so a change to it passes every round trip, yet breaks OpenVMM's broker and released guests, some of which run the C agent (Shared image-backed sandbox runtime #535). Only these vectors catch it.
• src/protocol/nvxs/tests/record.rs copies the 9 records of OpenVMM's vm/devices/virtio/virtio_console/test_data/control_session_protocol_vectors.txt, but not the 37 cases of control_session_protocol_cases.txt beside it.
• announcement_golden_vector, in src/guest/ingress/collect.rs (nvx-rs: replace the guest C programs with Rust binaries #358), and tests/guest_tools.rs pin the NVXL listener announcement. OpenVMM's decoder, in vm/devices/net/net_backend_resources/src/ingress.rs, has round-trip and rejection tests, but no vector file that both sides check.
• The tests can't call OpenVMM's broker: OpenVMM's workspace requires Rust 1.95 while nvx-rs supports 1.89, virtio_console depends on much of that workspace, and the nvx-rs CI job doesn't check out the submodule, whose deploy key fork pull requests lack.

Tasks

• Move the vectors into nvx-rs/tests/vectors/: nvxc-v1.txt for frames and EXEC, MAPS, and features payloads, and nvxl-v1.txt for announcements, in one documented line format, and link them from doc/design/4.4-host-guest-control-interface.md and doc/design/3.5-network.md.
• Copy OpenVMM's control_session_protocol_vectors.txt and control_session_protocol_cases.txt unchanged, with the OpenVMM commit that they come from, and check both: each vector decodes and encodes to its bytes, and each case is accepted or refused as it says.
• Add a test, ignored by default, that compares the copies with the submodule's files, and run it in the NVX CLI jobs, which check out the submodule, and in the checklist of the nvx-openvmm-promote skill.
• Rename the tests and comments that present the vectors as Python's output, such as host_attach_matches_the_python_client.
• Add proptest properties: records round-trip, and the NVXS record parser and the host's and the guest's EXEC and MAPS decoders return errors, never panic, on arbitrary bytes.
• Keep the wire-constant tests, and the C agent's parity constants while a supported release ships the C agent (nvx-rs: share one byte-level EXEC and MAPS decoder between the host and the guest #581).
• Offer nvxl-v1.txt to OpenVMM's decoder tests when convenient.
• Docs: the nvx::protocol row of the README's module table, its Testing section, and doc/contribute.md.

Rules

• A vector changes only with a protocol version. Exec v2 (nvx-rs: a shared credit and stdio engine for executions #623) gets vector files of its own, and v1 bytes that v2 refuses become rejection vectors.

Acceptance criteria

• Every byte that today's golden tests pin is checked from a vector file.
• OpenVMM's 37 cases are checked.
• CI checks the copies against the submodule.