[auser]

Part of the lifecycle review under #4839 (companion: #5390).

• HVF: pc + 4 on a guest-chosen PC (data-abort skip and the non-HVC exception path) trapped on overflow, so guest code could panic the vCPU thread. next_pc now wraps.
• HVF SMP: a panic on the boot CPU or a secondary skipped MachineShared::end, so thread::scope joined parked secondaries forever. A generic OnDrop guard (in smp.rs, so kernel_boot.rs stays under its size ceiling) ends the machine on unwind.
• Typed HTTP flow: cancellation stopped being watched once the response head was ready, so a guest Reset mid-body left the host framing a retired stream, which ends the whole session. The whole forward, response framing included, now runs under run_until_canceled.

Tests, each run against a broken version of its fix and then against the fix (unchanged):

test	broken	fixed
next_pc_wraps_at_the_top_of_the_address_space	FAIL (pc + 4 overflow panic)	pass
a_panic_while_a_cpu_is_parked_still_releases_it	FAIL (guard drop a no-op; the scope wedges, caught by a 5s timeout)	pass
a_reset_while_the_response_is_still_streaming_stops_the_forward	FAIL (5s timeout)	pass

The HTTP test exercises the helper, not the whole spawn_forward path (that needs a live substitution service); its broken variant is a stand-in for the old shape.

Footprint

The tests put the tree 63 SLOC over the ceiling (966163 merged with origin/main at 813a71c). To fit, this PR deletes functions with no reference anywhere in the repo (every symbol below occurs exactly once across .rs, .md, .toml, .feature and scripts, excluding target and third_party; none is cfg-gated, FFI, serde-visible, a claim witness, or named in xtask). Result: 966163 -> 966083 (ceiling 966100).

Deleted:

• mvm_build::runtime_layer::stage_runtime_layer, compose_runtime_layers: no callers. stage_tar stays, now #[cfg(test)], because its tar-refusal tests are kept.
• mvm_agentd::trusted_env::configure_explicit_command: no callers.
• mvm_agentd::builder_session::serve_build (plus the imports it alone used): no callers; the session wire types are untouched.
• mvm_vmm EgressGate::decide_addr: no callers (decide_addr_for_proto stays).
• mvm_client OfflineRevocationPolicy::load_from_host: no callers.
• libkrun_sys KrunContext::shutdown_eventfd: no callers.
• mvm_hostd with_artifact_collector: no callers.
• mvm_core::spawn_scope with_creation_timeout (test-support only): no callers.

These are pub items of workspace crates; a consumer outside this repository (for example mvmd) would break, and I could not check that.

Validation

On a tree merged with origin/main: fmt clean; just check::gated passes (Linux target and the bdd conformance check); clippy -D warnings --all-targets on the whole workspace clean; nextest of mvm-hostd, mvm-runtime, mvm-build, mvm-agentd, mvm-vmm, mvm-client, mvm-core and libkrun-sys 12145/12145; check-file-size, check-claim-catalog, check-witness-citations and check-rust-footprint (966083) pass. Not run: live HVF guests.

Refs #4839 (the umbrella stays open; this PR does not close it).