Package and verify the microVM runtime supply chain

Parent: #526

Outcome

Mecatl consumes verified go-microvm runtime and firmware artifacts without adding go-microvm/libkrun to the standard engine/root dependency graph.

Scope

• Create environment/microvm/ as a nested Go module containing mecatl-microvmd, the guest agent, platform wiring, and a thin client surface usable by root composition.
• Reuse go-microvm v0.0.39's existing Linux amd64/arm64 and Darwin arm64 release/OCI artifacts pinned to libkrun v1.19.4 and libkrunfw v5.5.0.
• Add signing and provenance/attestation to the upstream go-microvm runtime and firmware artifacts rather than rebuilding them independently in mecatl.
• Resolve every runtime, firmware, and execution-image reference to an immutable digest.
• Verify operator-approved signer identities and required attestation predicates before cache admission or VM creation.
• Keep cache writes atomic and safe under concurrent VM starts.
• Record verified runtime/firmware/image digests and policy revision in environment metadata.
• Produce SBOM/notices and reuse go-microvm's existing separate firmware packaging.

Acceptance

• Default mecatl builds and the engine module do not compile or link go-microvm/libkrun.
• Wrong digest, unsigned artifact, wrong signer, missing/wrong attestation, corrupted cache, or stale verification policy fails closed before VM creation.
• Successful verification is reproducible offline from the recorded digest/evidence after cache warmup.
• Concurrent pulls cannot expose partially verified artifacts.
• Linux and macOS artifact extraction never trusts archive traversal or symlink escapes.