nvx-rs slimming 5.2.3: the breaking release is published #1132

Parent: #1090, in #1076. Needs: #1091, #1112, #1119, #1120, #1123, #1126, #1127, #1129, #1130, #1131. Unblocks: —. No PR of this group merges before the API-ready commit.

Goal. The breaking release is published: the changelog of its breaking changes, and nvx at the next prerelease number that crates.io hasn't used.

PRs, in order. Each PR has one goal, leaves dev green, and names in its description each old test of its area as kept, rewritten or retired, with each change that check_test_changes.py reports. Its tests follow the repository's test layout: a module's unit tests, and the code that only they use, sit in its tests.rs or tests/ and move with it. The estimates count core lines (code, not comments, docs or tests) and counted files; each PR records its measured values. Each PR does what its Scope says and no more: a case, input or layout that its Scope doesn't name, and whatever "Not in this PR" lists, is out of scope. Address every review comment within the scope, and ask before acting on one that asks for more. A PR whose measured core lines pass the stop that its Estimate names (twice the estimate, at most 600) stops and asks before continuing.

1. SL8.1: The breaking release is published.
   • Objective: The breaking release is declared, checked and published as nvx. Consumers can verify its exact planned public surface, including one hidden main per binary, and install and run nvx-ingress independently with the guest profile.
   • Contents: The changelog of the breaking changes, and the package's declared version set to the release's: the next prerelease number that crates.io hasn't used. CI checks the package's contents and that its API snapshot holds exactly the planned public surface and one hidden main per binary, and publishes nvx alone. It installs nvx-ingress from the package outside the repository with cargo install nvx --no-default-features --features guest --profile guest --bin nvx-ingress, and runs it.
   • Scope:
     • Add one root CHANGELOG.md with a single entry for this release, listing its breaking changes and linking doc/migrate-from-alpha.7.md; add no other release document.
     • Set the package's declared version to the next unused prerelease number.
     • Check nvx's packaged contents and that its API snapshot has exactly the planned public surface and one hidden main per binary.
     • Publish nvx alone at that version.
     • Outside the repository, run cargo install nvx --no-default-features --features guest --profile guest --bin nvx-ingress, then run nvx-ingress.
   • Not in this PR:
     • Publishing any package other than nvx: NVX's programs are code of that package.
     • Choosing a prerelease number already used on crates.io.
     • Changing package contents, public API or guest-profile design; fix failures in those areas separately rather than expanding the release PR.
     • Adding another publisher or release channel; use the repository's existing release tooling and CI.
     • Backward-compatible state conversion or old-snapshot support: the migration guide requires fresh state.
   • Approach: After the nightly versions are known, select the next unused prerelease number and set it on the package. Reuse the existing package and publishing tools to check contents and the final API snapshot, then publish nvx alone. Outside the checkout, install nvx-ingress from that package with the guest feature and profile, and run it; do not build a general release system.
   • Done when:
     • The new root CHANGELOG.md has one release entry listing the breaking changes and linking the migration guide, and the package declares the next unused prerelease version.
     • Release CI validates nvx's contents and its exact planned API snapshot, including one hidden main per binary.
     • nvx alone is published at that version.
     • A standalone guest-profile install from nvx runs nvx-ingress successfully.
   • Needs: SL1.5, in nvx-rs slimming 1.1.1: the public API is checked, and NVX's programs are hidden from it #1091; SL3.11a, in nvx-rs slimming 3.1.7: the CLI uses only the new interface #1112; SL4.4d, in nvx-rs slimming 5.1.2: NVXC v1 and FEATURES are gone #1129; SL5.2, in nvx-rs slimming 4.1.2: the test adapter is gone #1119; SL6.8c, in nvx-rs slimming 4.3.3: the error codes are private #1126; SL6.10h, in nvx-rs slimming 5.2.2: the CLI, developer, CI and rustdoc docs, and the migration guide #1131; SL6.11b, in nvx-rs slimming 4.2.4: the exec engine, the process modules and the old layered init are gone #1123; SL6.11c, in nvx-rs slimming 4.2.1: the code that stays stops using what leaves #1120; SL6.12, in nvx-rs slimming 4.3.4: NVXC, the host's platform layer and the guest's space are private #1127; SL6.13b, in nvx-rs slimming 4.3.4: NVXC, the host's platform layer and the guest's space are private #1127; SL6.13c, in nvx-rs slimming 4.2.1: the code that stays stops using what leaves #1120; SL6.14, in nvx-rs slimming 4.3.4: NVXC, the host's platform layer and the guest's space are private #1127; SL7.8b, in nvx-rs slimming 4.2.4: the exec engine, the process modules and the old layered init are gone #1123; SL7.9, in nvx-rs slimming 5.2.1: the library's guide, its design and the guest-agent guidelines #1130.
   • Estimate: 80 core lines, 5 counted files. Past 160 core lines, stop and ask before continuing.

Tests. Release CI checks the package's contents and that the API snapshot holds exactly the planned surface and one hidden main per binary, publishes nvx, installs the guest tools from the package outside the repository with --no-default-features --features guest --profile guest, and runs nvx-ingress.

Done when: nvx is published at the release version, and release CI passes.