Disk encryption key and WireGuard key visible in /proc/PID/cmdline

The `setup_disk_encryption()` function in `dstack/dstack-util/src/system_setup.rs` passes the disk encryption key via the kernel command line when calling `cryptsetup`, which exposes the key in `/proc/cmdline` to any process in the CVM.

## Root Cause

The disk encryption key is passed to `cryptsetup` via a shell pipeline that makes it visible in `/proc/PID/cmdline`:

```bash
echo -n "$disk_crypt_key" | cryptsetup luksOpen ...
```

Similarly, the WireGuard private key is passed via `wg set` command arguments, which are also visible in procfs. Any process inside the CVM can read `/proc/*/cmdline` to extract these keys during the brief window when the commands are running.

## Attack Path

1. Attacker compromises any process inside the CVM
2. Attacker continuously polls `/proc/*/cmdline` for processes containing key material
3. During CVM boot or WireGuard setup, attacker captures the disk encryption key or WireGuard private key
4. With the disk encryption key, attacker can decrypt the persistent storage offline
5. With the WireGuard key, attacker can decrypt or inject network traffic

## Impact

Cryptographic key material is transiently exposed to all processes via procfs. While the window is brief (duration of the cryptsetup/wg commands), a persistent attacker polling procfs can reliably capture the keys.

## Suggested Fix

Pass keys via stdin instead of command line arguments or shell pipelines, so no key material appears in `/proc/PID/cmdline`:

```rust
use std::io::Write;
use std::process::{Command, Stdio};

// For cryptsetup: read key from stdin using --key-file=-
let mut child = Command::new("cryptsetup")
.args(["luksOpen", "--key-file", "-", "/dev/vda", "cryptroot"])
.stdin(Stdio::piped())
.spawn()?;

if let Some(mut stdin) = child.stdin.take() {
stdin.write_all(disk_crypt_key.as_bytes())?;
}

let status = child.wait()?;
```

For WireGuard, use `wg setconf` with a configuration file (on tmpfs with `0o600` permissions) instead of passing the key on the command line.

---
> **Note:** This issue was created automatically. The vulnerability report was generated by Claude and has not been verified by a human.

Review dstack/dstack-util/src/system_setup.rs, starting with setup_disk_encryption() and the WireGuard setup that invokes wg set. Verify whether the disk encryption and WireGuard keys appear in /proc/*/cmdline, then assess stdin for cryptsetup and setconf with a protected temporary configuration for WireGuard. Done means neither key is passed as a command-line argument or shell pipeline and the existing setup still succeeds.

Scritto dal modello di indicizzazione a partire dal testo della issue.