nvx-rs slimming 3.3.2: the managed agent's direct mode runs on nvx-init's exec core #1116

Parent: #1085, in #1076. Needs: #1109, #1115. Unblocks: #1117, #1123, #1128.

Goal. The managed agent's direct mode, which serves managed blockless VMs, runs its executions on nvx-init's plain-process core, with the default environment and PWD rules, and nvx-init's layered roots and managed blockless VMs share the agent's NVXC loop. Those paths use none of guest::{exec, spawn, process, cgroup, entry}; the setpriv helper path (helper and exec_config) and the direct mode's cgroups go. The sandbox mode, which only the old layered init starts, for the old CLI's layered launches, keeps its root entry, barrier and cgroup placement until #1123 deletes it with that init.

PRs, in order. Each PR has one goal, leaves dev green, and names in its description each old test of its area as kept, rewritten or retired, with each change that check_test_changes.py reports. Its tests follow the repository's test layout: a module's unit tests, and the code that only they use, sit in its tests.rs or tests/ and move with it. The estimates count core lines (code, not comments, docs or tests) and counted files; each PR records its measured values. Each PR does what its Scope says and no more: a case, input or layout that its Scope doesn't name, and whatever "Not in this PR" lists, is out of scope. Address every review comment within the scope, and ask before acting on one that asks for more. A PR whose measured core lines pass the stop that its Estimate names (twice the estimate, at most 600) stops and asks before continuing.

1. SL7.6a: The managed agent's blockless executions run on nvx-init's exec core.

   • Objective: Managed blockless VMs stop using the old direct-mode cgroup and setpriv helper path. guest::managed_agent uses guest::init's crate-private plain-process core in place while preserving the environments, working-directory rules, output behavior, and statuses that callers already observe.
   • Contents: In direct mode, which serves managed blockless VMs, guest::managed_agent uses guest::init's crate-private plain-process exec core in place for its execs (exec, launch, environment, and the entry point in mod) (SL7.5c), with no cgroups, namespaces or limits, and keeps the exact and layered environments and the default environment's and PWD's rules. The setpriv helper path goes (helper, exec_config and the helper's dispatch in mod), and so does the direct mode's code in the agent's cgroup module. Direct mode no longer uses guest::{exec, spawn, process, cgroup}. The sandbox mode, which only nvx-init-agent starts, for the old CLI's layered launches, keeps its root entry, barrier and cgroup placement until SL7.8b deletes it with that init. The direct-mode agent stops announcing EXEC_CGROUP, which it no longer provides: GuestFeatures::DIRECT_AGENT, and with it REQUIRED, drop that bit. The agent keeps its MappingTable; exec's signal, which no NVX binary uses, goes with exec.
   • Scope:
     • The direct-mode portions of guest::managed_agent's exec, launch, environment, mod, and cgroup modules; delete its helper and exec_config modules rather than moving them.
     • Exact environments, environments layered over the default, and the existing HOME, USER, LOGNAME, and PWD rules.
     • Credential failures, unusable working directories, output caps, exit statuses, cancellation, timeouts, and lost-status behavior on the plain-process core.
     • Removal of the direct-mode setpriv helper dispatch, sealed helper configuration, inherited descriptor, and cgroup preparation and settlement.
     • The direct-mode FEATURES response drops EXEC_CGROUP; the agent retains its public MappingTable.
   • Not in this PR:
     • The sandbox mode's root entry, launch barrier, and cgroup placement, which old CLI layered launches still need until SL7.8b.
     • Deletion of the whole managed-agent cgroup module: this PR edits it because sandbox mode still uses it.
     • Changes to exact or layered environment semantics, default variables, PWD, output caps, status precedence, cancellation, or timeout behavior.
     • Namespaces, replacement cgroups, per-exec limits, seccomp, or another privilege-dropping helper: the shared core performs the required child setup directly.
     • Exec's non-ending signal operation, which no NVX binary uses and NVXC v2 does not carry.
   • Approach: Route only AgentConfig::direct launches in guest::managed_agent through guest::init's child builder and execution driver, while leaving the sandbox branches intact. Fold the helper's environment work into the direct launch and reuse the core's credential sequence. Delete the helper protocol and remove only direct-mode cgroup calls.
   • Done when:
     • Direct-mode tests cover exact, layered and large environments, default variables, PWD, unusable directories, credential failures, output caps, statuses, cancellation, timeouts, and lost statuses on the new core.
     • Former helper integration cases run against the plain-process core, and credential-hardening coverage replaces the setpriv launch test.
     • Tests specific to helper syntax, its configuration format, inherited descriptor, and direct-mode cgroups are retired.
     • The direct-mode FEATURES response no longer includes EXEC_CGROUP, and direct mode uses none of guest::{exec, spawn, process, cgroup}.
     • Sandbox-mode tests for root entry, barrier, and cgroup placement still pass unchanged in behavior.
   • Needs: SL7.5c, in nvx-rs slimming 3.3.1: nvx-init boots a layered root, and runs each exec as a plain process #1115.
   • Estimate: 200 core lines, 7 counted files. Past 400 core lines, stop and ask before continuing.

2. SL7.6b: nvx-init's layered roots and managed blockless VMs share the agent's NVXC loop.

   • Objective: nvx-init layered roots and managed blockless VMs use one NVXC request loop and one mapping-table path. The shared loop no longer depends on the old guest execution, spawn, process, cgroup, or entry modules for either new path.
   • Contents: dispatch and seam in guest::managed_agent, with their MappingTable, serve guest::init's layered roots and managed blockless VMs without guest::{entry, spawn}, and the cold boot's workload identity comes from the CLI's tokens. Those paths use none of guest::{exec, spawn, process, cgroup, entry}; only the sandbox mode still does, until SL7.8b deletes it.
   • Scope:
     • dispatch, seam, and their mapping-table integration stay in guest::managed_agent and are adapted in place for the two managed paths.
     • One loop serves guest::init's layered-root mode and the managed blockless direct mode.
     • Shared dispatch covers reset, MAPS accounting and application, exec requests, cancellation, stop, and loopback behavior.
     • A layered cold boot receives its workload identity from the CLI's command-line tokens.
     • The two new paths use none of guest::{exec, spawn, process, cgroup, entry}.
   • Not in this PR:
     • Deleting the sandbox loop or its old guest-module dependencies, which SL7.8b does after the old layered init route disappears.
     • Changing NVXC payloads, mapping ordering, reset behavior, or the default environment and PWD rules established in SL7.6a.
     • A second loop for layered roots, mode-specific protocol adapters, or a pluggable dispatcher: both managed paths have the same protocol.
     • Restore activation and capture handling, which SL7.7a and SL7.7b add around the shared loop.
     • Reading OpenVMM's reserved workload tokens: cold boots use the tokens rendered by the CLI.
   • Approach: Adapt guest::managed_agent's dispatch and system seam in place, parameterizing only the mapping target, workload identity, and shutdown result. Reuse MappingTable and guest::init's exec core. Keep the sandbox branch in its old location until deletion rather than introducing a generalized multi-agent framework.
   • Done when:
     • One loop's tests cover layered-root and managed blockless dispatch, reset, mapping application, and loopback requests.
     • A cold-boot test obtains the workload identity from the CLI's tokens.
     • Both new paths run execs through the plain-process core and import none of guest::{exec, spawn, process, cgroup, entry}.
     • The old sandbox mode and its tests remain available for old CLI layered launches.
   • Needs: SL7.6a, above; SL3.4a1, in nvx-rs slimming 3.1.4: run uses the new interface and the CLI's own guest tokens #1109.
   • Estimate: 100 core lines, 3 counted files. Past 200 core lines, stop and ask before continuing.

Tests. The direct mode's exec tests run on the new core: exact and layered environments, PWD, unusable working directories, credential failures, output caps, exit statuses, cancellation, timeouts and lost statuses keep their coverage. The tests that cover only the direct mode's cgroups, the helper's configuration format, its inherited descriptor and its command-line syntax are retired. The helper's integration tests of exact, layered and large environments and of the workload's working directory are rewritten against the plain-process core, and the setpriv launch's test checks the core's credential hardening instead. The new paths have no cgroup, namespace, setpriv or helper mode, and the direct-mode agent's FEATURES answer no longer includes EXEC_CGROUP. One loop serves nvx-init's layered roots and managed blockless VMs, with its dispatch, reset, mapping and loopback tests. A cold boot's workload identity comes from the CLI's tokens. The sandbox mode's tests stay: the old CLI's layered launches still boot through the old layered init, enter their workload root and run their execs.

Done when: every PR above has merged, with dev green.