[Task]: Guest protocol, restricted binaries, and KubeVirt console command-path transport

Area

Operators

Description

Implement the controller-to-guest command path used by every later backup operation.

Includes:

• internal/guestprotocol: protocol v1 request/response framing, base64url line encoding, size limits, request-ID validation, allowlisted operations.
• dbaas-console: restricted login shell wrapper (no shell escape, no arbitrary command execution).
• dbaas-backupctl probe: initial privileged operation invoked through one exact sudoers rule.
• Debian package (dbaas-guest-tools) with sudoers configuration and control metadata.
• internal/guestconsole: hardened serial console state machine (stale-session recovery, CRLF/ANSI handling, bounded buffers, cancellation).
• Per-VM Kubernetes Lease for exclusive console access (90s duration / 30s renewal, takeover after controller failure).
• RBAC for virtualmachineinstances/console and coordination.k8s.io/leases.
• Operator-only guest access Secret (dbi-<uid>-guest-access), cleaned up via the existing finalizer/UID-label sweep.
• Cloud-init changes: dbaas-ops restricted account, explicit autoattachSerialConsole: true / logSerialConsole: false.
• dbaas-guestctl development CLI exposing probe.
• Protocol, guest-unit, and lease tests.

Completion Conditions:

• package installs on the target image
• dbaas-guestctl probe succeeds and fails safely with wrong credentials malformed/oversized messages, and an unreachable VLAN
• arbitrary commands cannot be executed
• stale sessions recover
• concurrent requests cannot share the console
• controller restart allows Lease recovery
• no secrets/transcripts reach logs
• serial-console logging stays disabled

Related Issues

No response