runtime adapter: the consumer-contract scenarios C2, C3, C6 and C7 on real VMs #859

Parent: #816. Needs: #822's PRs 3 and 7, and #805's PR 3. Unblocks: #624.

Goal. The test adapter's share of #535's consumer-contract suite runs on real VMs on KVM, MSHV and WHP:

• concurrency and backpressure (C2);
• root and non-root profiles (C3);
• crash recovery (C6);
• runtime identity (C7).

#624 then runs the full suite with both adapters. None of these scenarios blocks the snapshot/restore workstream (#833).

Today (dev d04d9fb):

• These scenarios run in-process, through the test brokers of tests/runtime-adapter/tests/guest_session.rs and host_session.rs.
• Some run in VMs through probes:
  • root profiles, through the entries probe's helper (vm_layered.rs, root_profiles_enter_the_root);
  • reattach, and a mismatched guest build (vm_restart.rs).
• runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP #822 and runtime adapter: settle executions through cgroups and run them in a VM #805 make real launches, executions and mapping tables run in VMs.

PRs. Three independent PRs; each lands with its own tests, which run in the adapter's CI hook on KVM, MSHV and WHP.

PR 1 of 3: concurrency, backpressure and profiles (C2, C3). Needs #805's PR 3.

• Concurrency and backpressure:
  • worker::MAX_EXECUTIONS executions at once with pooled frame credit, and one more, refused;
  • a stalled sink, which stalls only its own execution;
  • stdin beyond its window;
  • EOF, cancel, timeout, reset and dropped handles.
• Profiles, through real executions:
  • each allowed capability alone;
  • none;
  • a numeric identity without an account;
  • working directories that the entry refuses.

PR 2 of 3: crash recovery (C6). Needs #822's PRs 3 and 7.

• With runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP #822's step hook, the host program exits without unwinding at each step:

  • after the spawn;
  • after Ready;
  • after the mappings;
  • after Start;
  • before the commit.

  A later process recovers: it ends an uncommitted launch, or reattaches a committed one.

• The log claim; reattach to a VMM that isn't the caller's child; a recorded process identity that another process reuses, which is never signaled.

PR 3 of 3: runtime identity (C7). Needs #822's PR 7.

• Two host builds on one store:
  • the same runtime identity reattaches;
  • another finds the VM mismatched, and a new terminate command ends it through its verified identity, with Vmm::terminate.
• A guest whose build differs from the host's fails at Ready, and the launch tears the VM down.

Not in scope: NVX's adapter's scenarios (#624, with #817 to #821); the CLI's queue across processes (#819).

Done when: the three PRs are merged, and the scenarios pass in CI on the three backends.