metal: stand up a Confidential Containers (CoCo) runtime class on the k3s/Kata stack

[JSONbored]

Problem

#7180's isolation-tier decision fixed the hosted execution plane as self-hosted Kata Containers on bare metal under k3s, with Firecracker-backed runtime classes for tenant sandboxes. #8137 identified the attested-evaluation extension: Kata 3.x is the base of the Confidential Containers (CoCo) project, so hardware-attested confidential VMs arrive as an additional runtime class on the same stack — with two recorded caveats that must be honored, not rediscovered: (1) the confidential runtime classes use QEMU/cloud-hypervisor, not Firecracker (Firecracker has no SEV-SNP support) — a configuration split beside the sandbox classes, not a stack replacement; (2) SNP-capable hardware is prerequisite (the hardware sub-issue).

Requirements

• Install the CoCo runtime pieces on the k3s cluster and register a confidential RuntimeClass (e.g. kata-qemu-snp) alongside — never replacing — the existing Firecracker-backed classes.
• Stand up the attestation flow (KBS / attestation service): a workload in the confidential class can obtain a secret only after producing a valid SNP attestation; the same workload outside the class (or with a falsified measurement) is refused.
• Record the class's measurement/policy management procedure in the private infra docs (how a new image's measurement gets approved).
• Smoke evidence: one pod in the confidential class completes the full attest→verify→release cycle; the negative case (non-confidential class requesting the same secret) fails.

Deliverables

• Confidential RuntimeClass live on the cluster, Firecracker classes untouched
• Positive + negative attestation smoke results (redacted) recorded as a comment here
• The attested-runner sub-issue unblocked

Links & Resources

• Research: survey viable TEE/confidential-compute options on Cloudflare Workers/Containers #8137 (CoCo/SEV-SNP path + both caveats), Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (stack decision), the hardware sub-issue (blocked-by)
• Confidential Containers project docs; Kata SEV-SNP how-to

Boundaries

Cluster/runtime infrastructure only — no application code in this repo, no backtest wiring (the runner sub-issue owns that), no tenant workloads moved.

maintainer-only — cluster and attestation-infrastructure authority.

[linear-code]

JSO-5905