feat(guestd): replace the Health-only stub with the V2b in-guest supervisor (RIG-2493)

[rigel-mintaka]

This PR is part of a stack containing 5 PRs:

1. main
2. feat(guest_control): grow GuestControl with the V2b exec surface (RIG-2493) #696
3. "feat(guestd): replace the Health-only stub with the V2b in-guest supervisor (RIG-2493)" (this PR)
4. feat(runtime): host GuestExec layer + portable exit-signal error type (RIG-2493) #702
5. feat(runtime): fill MicroVMRuntime lifecycle methods (RIG-2493) #719
6. test(runtime): shared ContainerRuntime contract suite across both backends (RIG-2493) #720

U2 of the frozen microVM Runner V2b plan (docs/designs/infra/runtime/compass-elastic-session-runtime/microvm-v2b-guest-supervisor-exec.md, §Plan U2 / §(b)). Replaces the V2a healthService (which U1 left embedding UnimplementedGuestControlHandler to satisfy the widened interface) with the full supervisor implementing every GuestControl RPC.

What

• State gate (booting → ready → provisioned, mutex-guarded): Exec/ExecStream refuse with FailedPrecondition until Provision opens the gate.
• Provision records default_exec_uid (validated non-zero) + base_env; a non-empty nft_script answers Unimplemented (V3's); a second call or a not-ready guest answers FailedPrecondition.
• Exec (one-shot): uid resolve (absent → session default, 0 → refused), env merge (exec keys win), stdin via bytes.Reader never argv, 8 MiB-capped stdout/stderr buffers (ResourceExhausted on overflow — the acknowledged divergence from the podman contract, OQ-E), guest-side timeout, non-zero exit is a successful ExecResponse, ctx-cancel → SIGKILL + reap.
• ExecStream (bidi): first frame must be StartExec; ExecStarted is emitted first; a shared send-mutex serializes the demuxed stdout/stderr/ExecExit down-frames; stdin frames + StdinClose half-close the child; a broken stream or ctx-cancel → SIGKILL + reap; the terminal ExecExit always comes from our own reap.
• Signal: exec_id → process-group signal; unknown/exited exec → no-op success; empty exec_id → initiateStop (the §(d) guest-stop path).
• Stop → power-off: run() derives a serving ctx wired to stopServing; after serve returns, an RPC-triggered stop with no serve error calls powerOff() (syscall.Reboot(LINUX_REBOOT_CMD_POWER_OFF)), the PID-1-legal shutdown. The Unix-signal path (cmd/compass-guestd signal.NotifyContext) is a distinct trigger and returns as before, per §(d).
• Peer-CID guard: peerCIDListener refuses any non-host CID before the first HTTP byte (hermetic non-vsock listeners are allowed); the handler carries WithReadMaxBytes(16 MiB) (OQ-E).
• Boot nonce: cmdline.go parses compass.boot_nonce=<hex> (absent → nil, empty/non-hex → error); the supervisor echoes it on HealthResponse.boot_nonce (U1's additive field) so Start binds the guest to the VM it launched (§(e)).

Boot steps 1–4 are byte-identical; only the serve step is retyped to *supervisor and gains the powerOff seam.

Verification

go build ./... clean (whole module); go test ./internal/guestd/... ok; go test -race ./internal/guestd/... ok; gofmt -l internal/guestd/ clean. The hermetic suite (supervisor_test.go) drives an in-memory h2c listener with real host child processes and covers every §(b) acceptance row (gate refusal, uid-0 refusal, default-uid resolution, stdin-not-argv, env merge, non-zero-exit success, stream demux ordering, signal-kills-live-child, signal-on-exited no-op, broken-stream reap, peer-CID pure function, RPC-stop → power-off).

Ledger-impact: none

Spec-impact: none. Refs RIG-2493

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2493

[github-actions]

Compass engineering docs preview: https://compass-runner-rig-2493-u2-g.compass-eng-docs.pages.dev

Deployed from compass-runner/rig-2493-u2-guestd-supervisor at 8a86859.