nvx-rs slimming 2.3.1: activation record v2 carries only what the guest applies #1101

Parent: #1081, in #1076. Needs: #1091, #1097, #1099. Unblocks: #1103, #1105, #1113.

Goal. The activation record carries only what the guest applies. Record v2 drops the template reference, the store generation, the image's and the scratch's binding identities, the export's plan identity, the network's policy identity and the workload identity, and keeps the image's expected EROFS UUID or GPT disk GUID; View replaces WorkloadView, and Upper::Tmpfs carries the RAM upper's cap. VERSION becomes 2, so an old record fails closed. The prepared launch then supplies a restore's record and NIC.

Notes.

• Readers first. One PR removes every reader of what v2 drops, outside the codec; the next changes the host's encoder, the guest's decoder, the record writers and the fixtures together.
• The runtime adapter's edits follow runtime-adapter: move the tests out of their sources, and retire the layout baseline #1198. SL2.5a and SL2.5b edit tests/runtime-adapter/src/, which runtime-adapter: move the tests out of their sources, and retire the layout baseline #1198 edits as it moves the adapter's tests out of its sources, so they start from a dev that contains it.

PRs, in order. Each PR has one goal, leaves dev green, and names in its description each old test of its area as kept, rewritten or retired, with each change that check_test_changes.py reports. Its tests follow the repository's test layout: a module's unit tests, and the code that only they use, sit in its tests.rs or tests/ and move with it. The estimates count core lines (code, not comments, docs or tests) and counted files; each PR records its measured values. Each PR does what its Scope says and no more: a case, input or layout that its Scope doesn't name, and whatever "Not in this PR" lists, is out of scope. Address every review comment within the scope, and ask before acting on one that asks for more. A PR whose measured core lines pass the stop that its Estimate names (twice the estimate, at most 600) stops and asks before continuing.

1. SL2.5a: No consumer outside the codec and its schema reads what record v2 drops.

   • Objective: Record v2 removes fields that current host, guest and test-adapter code still reads. This PR removes those consumers first, so the codec can change without retaining compatibility fields or mixing unrelated behavior into the schema PR.
   • Contents: Reattaching a clone checks its template through the clone record, which already matches the lease (nvx-rs/src/host/template/clone/records.rs), instead of the activation record (reattach.rs). The guest's apply drops the identity's extraction, the workload account check and the identity's propagation together, and Applied loses its identity: Applied::identity and the identity field go, and into_parts no longer returns one. The test adapter's readers follow: its worker, activation and guest-session code, and the clone-start tests.
   • Scope:
     • nvx-rs/src/host/template/clone/reattach.rs checks the template through the clone record already matched to the lease, rather than through the activation record.
     • nvx-rs/src/guest/clone/activation/apply.rs stops extracting and checking the workload identity, and Applied stops storing, returning or exposing it.
     • The runtime adapter's worker, activation and guest-session readers follow the smaller Applied result, and the clone-start fixtures use the clone record for template mismatch cases.
   • Not in this PR:
     • Changing the activation schema, codec, version or canonical fixtures; SL2.5b changes them together.
     • Deleting TemplateReference, StoreGeneration or activation::Identity; the old stores still use those types until SL6.1.
     • Replacing the test adapter or redesigning execution identities; this PR only removes its reads of fields that record v2 drops.
     • Changing clone leases, clone records or their matching rules; the existing clone-record check is reused.
   • Approach: Redirect the one host check to the existing clone record, then remove the identity value along the guest apply and Applied data flow. Update direct test-adapter consumers and fixtures in place; do not add a compatibility accessor, duplicate the template reference or introduce a transitional record type.
   • Done when:
     • Reattaching a clone accepts the matching clone record and refuses a template mismatch shown only by that record.
     • Applied has no identity accessor or field, and into_parts no longer returns an identity.
     • Tests that checked the workload account through the activation record are rewritten or retired, and the runtime-adapter readers compile against the smaller result.
   • Needs: SL0.4, in nvx-rs slimming 1.1.1: the public API is checked, and NVX's programs are hidden from it #1091.
   • Estimate: 80 core lines, 2 counted files. Past 160 core lines, stop and ask before continuing.

2. SL2.5b: The activation record carries only what the guest applies.

   • Objective: The activation record currently carries store and host-planning identities that the guest does not apply. Record v2 contains only the guest-applied configuration and transaction, so hosts and guests share a smaller contract and reject old records.
   • Contents: Record v2: drop the template reference, the store generation, the image's and the scratch's binding identities, the export's plan identity, the network's policy identity, and WorkloadIdentity; keep the image's expected EROFS UUID or GPT disk GUID; View replaces WorkloadView; Upper::Tmpfs carries the RAM upper's cap; bump VERSION, so an old record fails closed. The host's encoder (nvx-rs/src/host/template/clone/record.rs) and the guest's decoder follow in the same PR, with the record writers and fixtures. The old stores keep TemplateReference, StoreGeneration and activation::Identity, which record v2 doesn't encode, until SL6.1.
   • Scope:
     • nvx-rs/src/activation/mod.rs and activation/codec.rs define record v2, with View in place of WorkloadView and a transaction-only restore section.
     • The record drops the template reference, store generation, workload identity, image and scratch binding identities, export plan identity and network policy identity.
     • The image's optional expected EROFS UUID or GPT disk GUID remains, and Upper::Tmpfs carries the RAM upper's percentage cap.
     • nvx-rs/src/host/template/clone/record.rs, the guest decoder, record writers and canonical host, guest and runtime-adapter fixtures change together.
     • VERSION becomes 2; a v1 record is refused rather than translated.
   • Not in this PR:
     • Version negotiation, a reader or migration for an alpha.7 record, or record roots for snapshot tiers other than Fresh: this release reads no alpha.7 record and implements Fresh only.
     • Deleting TemplateReference, StoreGeneration or activation::Identity from the crate; old stores retain them until SL6.1.
     • An opaque caller payload, workload startup data or the mapping table; callers send their own data after Ready.
     • Changing image UUID or disk-GUID validation in the guest; only the surrounding record shape changes.
   • Approach: Edit the existing schema and codec in place, keeping its bounded field parser and canonical encoding. Remove obsolete fields rather than reserving compatibility storage, reuse View and the configured RAM cap, and update both producer and consumer in one PR; do not create a parallel v2 module or a generic extension mechanism.
   • Done when:
     • Canonical host and guest fixtures round-trip the root, View, export mapping count, network, expected resources and transaction.
     • Fixtures show that none of the removed references or identities is encoded, while the optional EROFS UUID or GPT disk GUID still round-trips.
     • Upper::Tmpfs round-trips its RAM cap, and a v1 record fails closed.
     • The guest still refuses an image whose EROFS UUID or GPT disk GUID differs from the record.
   • Needs: SL2.5a, above; SL2.3a, in nvx-rs slimming 2.1.1: one value for a VM's configuration #1097.
   • Estimate: 180 core lines, 5 counted files. Past 360 core lines, stop and ask before continuing.

3. SL2.6: A restore's record and NIC come from the prepared launch.

   • Objective: A VmConfig alone does not describe the effective NIC and activation settings of a restore, because the snapshot fixes the NIC while the restore supplies its own network policy. The prepared launch exposes the resolved record and NIC that will actually run.
   • Contents: Prepared::activation_record(&self, tx: TransactionId) -> Result<ActivationRecord>, a restore's record, and Prepared::nic(&self) -> Option<NicConfig>, the NIC as launched; both use the configuration resolved against the snapshot when there is one: a restore's NIC has the snapshot's presence and captured address, and its record carries the DNS, publication and proxy of the restore's own network policy, which SL2.16 installs. The restore arguments come with their caller, in SL2.16.
   • Scope:
     • Prepared::activation_record(&self, tx) builds an ActivationRecord from the configuration resolved during host::vm::create and preserves the supplied transaction.
     • Prepared::nic(&self) returns no NIC for a launch without one, the effective cold-launch NIC, or the snapshot's captured NIC for a restore.
     • A cold launch with NetworkConfig.guest_network unset uses NVX's default guest address.
     • A restore record uses the snapshot's NIC presence and address with the DNS, publication and proxy from the restore's own network policy.
   • Not in this PR:
     • Rendering restore arguments or installing --restore-network-policy; SL2.16 adds the restore caller.
     • Opening a snapshot or deciding whether it accepts a VM; SL2.12b and SL2.12c provide those operations.
     • Changing a captured NIC's address during restore; this release requires the captured address.
     • Persisting records or NICs outside Prepared; callers decide what state they keep.
   • Approach: Use the already checked, resolved values held by Prepared as the single source for both methods. Share the existing record and NIC construction paths for cold launches, substituting only snapshot-fixed values for restores; do not re-open the snapshot, recompute configuration from paths or add a second restore configuration type.
   • Done when:
     • activation_record keeps the caller's transaction and returns the cold launch's effective configuration.
     • For a restore, activation_record combines the snapshot-resolved NIC with the restore policy's DNS, publication and proxy.
     • nic covers no NIC, an explicit cold NIC, NVX's default cold address and the captured restore NIC.
   • Needs: SL2.5b, above; SL2.8, in nvx-rs slimming 2.2.1: a VM is created in a private directory, with its restore-ready listener, then spawned #1099.
   • Estimate: 150 core lines, 2 counted files. Past 300 core lines, stop and ask before continuing.

Tests. Record v2's canonical host and guest fixtures round-trip the root, View, the export and its mapping count, the network, the expected resources and the transaction; its restore section holds only the transaction; Upper::Tmpfs carries the RAM cap; and no template reference, store generation, workload identity, image or scratch binding identity, export plan identity or network policy identity is encoded; the image's optional expected EROFS UUID or GPT disk GUID still round-trips, and the guest still refuses an image that doesn't match it. A v1 record fails closed. Reattaching a clone checks its template through the clone record, and refuses a mismatch that only that record shows. Applied has no identity, and the tests that checked the workload's account through the record are rewritten or retired with it. Prepared::activation_record keeps the transaction that it is given and uses a restore's values resolved against the snapshot. Prepared::nic returns no NIC when none is launched, the effective NIC for a cold launch, NVX's default address included when NetworkConfig.guest_network is unset, and the snapshot's NIC for a restore. The test adapter's readers and clone-start fixtures follow record v2.

Done when: every PR above has merged, with dev green.