feat(runtime): fill MicroVMRuntime lifecycle methods (RIG-2493) - #719

… (RIG-2493)

U3 + U3b of the frozen microVM Runner V2b plan (`docs/designs/infra/runtime/compass-elastic-session-runtime/microvm-v2b-guest-supervisor-exec.md`, §Plan U3/U3b, §(c)/§(e)). The host-side client half of the exec control plane: a `GuestExec` layer over U1's generated `GuestControl` client, plus the backend-portable error type the runner's kill-classifier keys on.

### U3b — portable exit-signal error (`internal/runtime/exit_status_error.go`, new)

`ExitStatusError{Code int; Signal syscall.Signal}` with `Error()`, in package `runtime`. A remote guest exec cannot forge an `*exec.ExitError`, so the microVM `waitFunc` constructs this instead for a signalled guest exit. `internal/runner/agent_exec.go`'s `isDeliberateKill` is widened to `errors.As` on `*runtime.ExitStatusError` **first** (a non-zero signal ⇒ deliberate kill), then the existing `*exec.ExitError` SIGKILL branch **unchanged** — so the podman byte-path is byte-identical and only the microVM backend gets the new classification.

### U3 — GuestExec layer (`internal/runtime/microvm/exec.go`, new)

Plain structs (`ExecCall`/`ExecResult`/`StreamCall`/`ExitStatus`) mirror the proto so `runtime` types don't leak into `microvm` (`microvm` must not import `runtime`; U4 makes `runtime` import `microvm`).

- **`Exec`** (one-shot RPC): a non-zero exit is a successful `ExecResult`; a refusal/transport failure is an error; a host-side timeout → `*microvm.TimeoutError`.
- **`ExecStream`** (bidi): opens the stream, sends `StartExec`, **awaits `ExecStarted`** before returning; per-exec goroutines pump the `Stdin` pipe → stdin frames (`Close` → `stdin_close` + `CloseRequest`) and demux `stdout`/`stderr` response frames onto `io.Pipe` read ends, closing them on `ExecExit`.
- **`GuestStream.Kill`** issues a `Signal` RPC bounded by `killSignalTimeout` (never blocks teardown past it); **`Wait`** blocks on the demux goroutine and returns `ExitStatus{Code,Signal}`. A ctx-cancel stream break reports SIGKILL — guestd reaps the child bound to the broken stream.

### `podman.go` — funcs-backed ChildHandle

Adds unexported `newChildHandleFuncs(kill, wait func() error) *ChildHandle` plus `killFunc`/`waitFunc` fields. `Kill`/`Wait`/`Terminate` branch to the funcs path when `killFunc != nil`, else drive the original `cmd`/`cancel` path **untouched** (podman byte-unchanged). `Terminate` = kill then wait, returning the wait error (the exit status) when non-nil else the kill error — so a crash-vs-teardown consumer gets the exit signal.

### Verification

`go build ./internal/runtime/... ./internal/runner/...` clean; `go vet` clean over `runtime`, `runtime/microvm`, `runner`. Tests (all hardware-independent, no `microvm` build tag, no KVM):

- `exec_test.go` — fake `GuestControl` server on a unix listener over h2c Connect, dialed by a real client: one-shot non-zero exit is success + spec mapping; refusal is an error; one-shot timeout → `*TimeoutError`; stream demux ordering (interleaved frames land on the correct pipes, drained concurrently); stdin framing + `Close` → `stdin_close`; `Kill` issues the `Signal` RPC and `Wait` unblocks on the signalled exit; ctx-cancel breaks the stream and `Wait` reports SIGKILL.
- `child_handle_test.go` — `newChildHandleFuncs`: `Kill` invokes/propagates; `Wait` surfaces `*ExitStatusError` unchanged; `Terminate` return-value precedence.
- `deliberate_kill_test.go` — `isDeliberateKill` accepts a real `*exec.ExitError` from a SIGKILLed local child (podman-path regression guard) and `*runtime.ExitStatusError{Signal: SIGKILL}`, rejects a non-signal `ExitStatusError`, an unrelated error, and nil.

Ledger-impact: none

Spec-impact: none. Refs RIG-2493

Co-authored-by: Matt Wilkinson <matt@rigel.build>

U4 of the frozen microVM Runner V2b plan (docs/designs/infra/runtime/compass-elastic-session-runtime/microvm-v2b-guest-supervisor-exec.md, Plan U4 / (c)/(d)/(e)). Fills the eight typed-error MicroVMRuntime stubs behind their frozen ContainerRuntime signatures against the V2a boot harness + the U3 GuestExec layer.

### Socket-path budget (CI fix, folded)

`e2eConfig` built its runroot with `t.TempDir()`, whose path embeds the test-function name. Under the 39-char `TestMicroVMExecStreamingKillSignalsExit` the widest per-session socket path — `<RunRoot>/microvm/<32-hex id>/virtiofsd.sock`, a 56-byte tail — reached 114 bytes, over the 107-byte Linux AF_UNIX `sun_path` cap, so virtiofsd's `bind(2)` failed EINVAL, the socket never appeared, and the boot timed out (`… did not appear within 10s`). `TestMicroVMLifecycleEndToEnd` (28-char name, 103 bytes) fit and booted. Production runroots are short and startup-budget-checked (`run.go` validateRuntimeDir); this is a pure harness artifact. Fix: `e2eConfig` uses a short `os.MkdirTemp("", "cvm")` runroot (cleaned via `t.Cleanup`), keeping the worst-case path well under the cap.

Refs RIG-2493

Co-authored-by: Matt Wilkinson <matt@rigel.build>