Feat/linux support

[AdminTurnedDevOps]

Implemented

• Portable Linux/macOS libkrun binding, lifecycle, signals, KVM preflight, and actionable diagnostics.
• Architecture-specific immutable images, manifests, digest verification, session metadata, locking, and safe resume checks.
• Rootless Linux image builds with unprivileged guest commands and stripped setuid bits.
• Linux Secret Service support and trusted helper paths.
• Pinned CI dependencies, release packaging, dual Arch/Fedora hardware gates, attestations, and documentation updates.
• Linux/KVM support remains explicitly Planned until hardware evidence passes.
  Verified
• Full cgo-disabled tests and vet.
• Focused race tests.
• amd64/arm64 guest and VMM stub builds.
• Real cgo build against checksum-pinned Arch libkrun 1.19.4.
• Rootless amd64 image build, ext4 checks, UID 1000 repository ownership, manifest digest, and ELF validation.
• Actionlint, shell syntax, symbol manifest, and git diff --check.

We also put back git worktree support. The original intent was "why is a worktree needed for this?" and the reason is the purpose of the git worktree was to omit things that weren't necasasry for the sandbox like build images and such, which resulted in a smaller snapshot.

The Git-aware snapshot included:

• Committed/tracked project files.
• Modified tracked files.
• Untracked files not excluded by .gitignore.
• No .git metadata.
• No ignored build outputs, caches, VM images, dependencies, or generated artifacts.
  This produced a smaller, safer, project-focused snapshot. Git also provided a stable baseline for tracking guest changes and exporting patches.

Removing git worktree support caused a major regression where effectively, all of the files within a directory where you started abox would be within the snapshot, causing major increases in storage.