Certify and operate microVM environments on Linux and macOS

Parent: #526

Outcome

The microVM execution environment is demonstrably operable and safe on Linux amd64/arm64 and Apple Silicon macOS, with production diagnostics, quotas, cleanup, and release documentation.

Scope

• Add live opt-in E2E using real go-microvm/libkrun artifacts on Linux amd64/arm64 and Darwin arm64.
• Certify the minimum macOS version against pinned libkrun requirements and Brood Box behavior.
• Exercise boot, artifact verification, worktree mounting, Git reconstruction, filesystem CAS, exec streaming/cancel, guest egress, detach/reattach, concurrency, deletion, crash reconciliation, and hostile inputs.
• Add bounded low-cardinality metrics for boot latency, active/booting VMs, resource usage, execs, egress denials, verification failures, cleanup/reconciliation, and quota rejection.
• Add operator diagnostics/doctor output for hypervisor availability, runtime/firmware verification, control socket, network provider, profile availability, and stale resources.
• Document installation, platform prerequisites, security boundary, residual risks, artifact trust, workspace paths, retention, and recovery.
• Keep ordinary task test offline and KVM/HVF-free; live hypervisor jobs are explicit gates.

Acceptance

• The supported platform matrix runs the same behavioral suite; platform exceptions are explicit and documented.
• A malicious guest cannot access host provider/MCP/identity credentials, the driver control socket, unrelated host roots, sibling worktrees, or sibling guest endpoints through the configured capability surface.
• Resource exhaustion and crash scenarios remain bounded and recoverable.
• Diagnostics contain no command contents, environment secrets, registry credentials, or unbounded IDs as metric labels.
• task lint, task test, task api:check, task docs, task site:build, the offline demo, and the opt-in live platform suite are green.