nvx-rs: lower, capture and publish platform templates #841

Parent: #834 (#833), step 2. Needs: #839, #840, and #822's PR 2 (the adapter plan and the checked handoff in the test adapter). Unblocks: #844.

Goal. create and refresh capture a tenant-free template through the supervisor, and publish it into the store as a new generation.

Today (dev d04d9fb):

• Only scripts capture: scripts/nvx_tools/microvm_tests.py passes --snapshot-tier platform, then drives capture and restore (:7008-7011, :7254-7320).
• nvx::host renders OpenVMM arguments through LaunchSpec, SandboxPlan, PreparedLaunch, ExportPlan and network::openvmm_arguments, with no capture options (nvx-rs/src/host/launch.rs:234, sandbox/plan.rs:587, sandbox/prepared.rs:282, filesystem.rs:1737, network/mod.rs:632).
• network::openvmm_arguments attaches no NIC for deny-all egress with ingress and host loopback denied and no proxy (network/mod.rs:632-665).
• OpenVMM's platform allowlist admits a fixed set of command-line tokens (openvmm/openvmm_helpers/src/snapshot/microvm.rs:2326-2350).

Stacked PRs. Each PR builds on the one before it, and lands with its own tests.

PR 1 of 3: template lowering. Needs #839's PR 1.

• TemplatePlan, lowered from an adapter plan (SandboxPlan::adapter):

  • the placeholder distro, bound through DistroBinding. It's a trusted platform artifact, and its size is every clone's image capacity;

  • a dormant scratch device. A sparse file in the capture's transaction sets its length and block sizes, and isn't kept;

  • a dormant filesystem slot;

  • no NIC, or one fixed NIC with the template's policy;

  • CPUs, all online (B = C in this stage), and memory, with --memory-capacity;

  • a command line of allowlisted tokens only:

    • earlycon=xe9, console=hvc0, console=hvc1, reboot=t, panic=-1;
    • nvx_sandbox=1, nvx_config=0xd0010000,65536, nvx_snapshot_tier=platform, nr_cpus=, and the control TTY token;
    • virtio_mmio.device=, and the fixed NIC's virtnet_ip=, virtnet_mask=, virtnet_gw=, virtnet_dns=, virtnet_ip6= and virtnet_gw6=.

    It holds no image identity, hostname, shares, proxy, entrypoint or other tenant data.

• The capture options: --snapshot-tier platform, a --snapshot-destination inside the transaction, and --snapshot-block-identity generation --snapshot-generation-id <nonzero>, so that the capture hashes nothing.
• Tests: each token against OpenVMM's allowlist; no tenant data on the command line; the rendered arguments.

PR 2 of 3: capture and publication. Needs PR 1, and #839's PRs 2 and 3.

• Store::create returns an existing compatible and eligible generation of the capture class, or captures one. Store::refresh always captures a new generation, which later restores select by default. Older generations and their leases are untouched.

• Captures of one class are serialized. Each opens a private transaction directory on the store's volume, and cold-launches through supervisor::launch and PreparedLaunch. It opens no application session, and waits for no Ready: the guest captures through nvx-rs: capture preparation in the guest, and template mode in the test adapter's guest #840.

• Checks: the source's verified exit; the manifest, through TemplateManifest::read; the artifacts' kinds and lengths, without reading their content.

• Publication, in two commits:

  1. OpenVMM publishes into the transaction.
  2. The host closes its handles, renames the envelope (OpenVMM's directory, with the host's metadata beside it) into the store without replacing anything, and commits the index with the full key.

  Only indexed generations can be acquired, and a committed generation is never rewritten. Recovery completes a checked transaction or retires it; a generation lost in a crash is dropped from the index.

• On failure, the guest releases its barriers, and the host tears down the VM. A template VM never becomes a sandbox.

• Tests, with a fake VMM: failures around each commit; existing generations preserved; orphans recovered; links, reparse points and unsafe ownership, refused; serialized captures of one class.

PR 3 of 3: captures in VMs through the test adapter. Needs PR 2, #840's PR 2, and #822's PR 2.

• The test adapter gets a create path for these tests; runtime adapter: template and clone operations #847 completes its operations.
• Tests, in MicroVM CI on KVM, MSHV and WHP, with the test adapter's template mode: captures without a NIC, and with one per tested policy.

Not in scope: restore (#844); OpenVMM's own RAM publication, which stays as it is, on Linux and NTFS, with no ReFS claim.

Guide (#591's numbering): 2.1.1 (the allowlisted command line), 2.1.3 (the placeholder and the dormant scratch), 3.4.5 and 3.6.10 (dormant devices at capture), 5.3.1 and 5.3.3 (capture configuration and transaction), 5.4.1 (the store's publication), 5.4.4 (the platform tier).

Done when: the three PRs are merged, and templates capture in CI on the three backends.