feat(runtime): host GuestExec layer + portable exit-signal error type (RIG-2493) - #702

…rvisor (RIG-2493)

U2 of the frozen microVM Runner V2b plan (`docs/designs/infra/runtime/compass-elastic-session-runtime/microvm-v2b-guest-supervisor-exec.md`, §Plan U2 / §(b)). Replaces the V2a `healthService` (which U1 left embedding `UnimplementedGuestControlHandler` to satisfy the widened interface) with the full `supervisor` implementing every `GuestControl` RPC.

### What

- **State gate** (`booting → ready → provisioned`, mutex-guarded): `Exec`/`ExecStream` refuse with `FailedPrecondition` until `Provision` opens the gate.
- **`Provision`** records `default_exec_uid` (validated non-zero) + `base_env`; a non-empty `nft_script` answers `Unimplemented` (V3's); a second call or a not-ready guest answers `FailedPrecondition`.
- **`Exec`** (one-shot): uid resolve (absent → session default, `0` → refused), env merge (exec keys win), stdin via `bytes.Reader` never argv, 8 MiB-capped stdout/stderr buffers (`ResourceExhausted` on overflow — the acknowledged divergence from the podman contract, OQ-E), guest-side timeout, non-zero exit is a **successful** `ExecResponse`, ctx-cancel → SIGKILL + reap.
- **`ExecStream`** (bidi): first frame must be `StartExec`; `ExecStarted` is emitted first; a shared send-mutex serializes the demuxed `stdout`/`stderr`/`ExecExit` down-frames; stdin frames + `StdinClose` half-close the child; a broken stream or ctx-cancel → SIGKILL + reap; the terminal `ExecExit` always comes from our own reap.
- **`Signal`**: `exec_id` → process-group signal; unknown/exited exec → no-op success; empty `exec_id` → `initiateStop` (the §(d) guest-stop path).
- **Stop → power-off**: `run()` derives a serving ctx wired to `stopServing`; after serve returns, an RPC-triggered stop with no serve error calls `powerOff()` (`syscall.Reboot(LINUX_REBOOT_CMD_POWER_OFF)`), the PID-1-legal shutdown. The Unix-signal path (`cmd/compass-guestd` `signal.NotifyContext`) is a **distinct** trigger and returns as before, per §(d).
- **Peer-CID guard**: `peerCIDListener` refuses any non-host CID before the first HTTP byte (hermetic non-vsock listeners are allowed); the handler carries `WithReadMaxBytes(16 MiB)` (OQ-E).
- **Boot nonce**: `cmdline.go` parses `compass.boot_nonce=<hex>` (absent → nil, empty/non-hex → error); the supervisor echoes it on `HealthResponse.boot_nonce` (U1's additive field) so Start binds the guest to the VM it launched (§(e)).

Boot steps 1–4 are byte-identical; only the serve step is retyped to `*supervisor` and gains the `powerOff` seam.

### Verification

`go build ./...` clean (whole module); `go test ./internal/guestd/...` ok; `go test -race ./internal/guestd/...` ok; `gofmt -l internal/guestd/` clean. The hermetic suite (`supervisor_test.go`) drives an in-memory h2c listener with real host child processes and covers every §(b) acceptance row (gate refusal, uid-0 refusal, default-uid resolution, stdin-not-argv, env merge, non-zero-exit success, stream demux ordering, signal-kills-live-child, signal-on-exited no-op, broken-stream reap, peer-CID pure function, RPC-stop → power-off).

### Guest PATH resolution (CI fix, folded)

`buildChild` spawned via `exec.Command(argv[0], …)`, whose bare-name resolution runs `LookPath` against guestd's OWN process environment — and guestd is PID 1 with no `PATH`, so a bare `argv[0]` (`echo`, `sh`, and in production `compass-agent`) never resolved: the first live KVM boot failed the exec rows with `executable file not found in $PATH`. The hermetic suite false-greened because it runs in-process with the test's ambient `PATH`. Fix (the container-baked-PATH analog, §(b)): `mergeEnv` floors a default `PATH=/bin:/usr/bin:/sbin:/usr/sbin` when neither the session base env nor the exec env supplies one, and `buildChild` resolves `argv[0]` against that merged `PATH` (via `resolveProgram`, honoring the session env, not the process env) — a name with a slash is used as-is, so absolute-path execs are unchanged. Regression: `TestExecResolvesBareCommandViaSessionPATH` (a base_env PATH pointing at a probe absent from the process PATH; fails before the fix) and `TestMergeEnvFloorsDefaultPATH`.

Ledger-impact: none

Spec-impact: none. Refs RIG-2493

Co-authored-by: Matt Wilkinson <matt@rigel.build>