Enable nested KVM on M3 and newer Apple Silicon

[obrr-hhx]

Summary

• validate that the bundled QEMU 11.1.1 runtime contains the upstream Apple HVF EL2 and platform-GIC capabilities
• probe a disposable virt,gic-version=3,virtualization=on machine before launch, enabling EL2 on supported Macs while retaining the existing EL1 path elsewhere
• cover both the nested and fallback launch arguments in the shell contract suite and document /dev/kvm availability
• align the staged-QEMU persistent-storage test with the QEMU 11.1.1 version already pinned on main

Verification

• built the complete pinned QEMU 11.1.1 runtime from source (1,556 Ninja targets); relocation, capability gates, signing, and macOS 15 compatibility passed
• created a disposable nested HVF/vGIC machine through QMP on an M5 Pro host
• booted the packaged ARM64 guest at EL2 with the PR runtime and verified /dev/kvm, KVM_GET_API_VERSION = 12, and a successful KVM_CREATE_VM
• passed the build-cache, guest contract, macOS compatibility, runtime relocation, port-forwarding, nested/fallback launch, power-action, and persistent-storage suites
• make test reaches the Swift test target locally, where the Command Line Tools-only installation lacks the Testing module; the Swift product itself builds and CI's macOS 15 environment remains the authoritative Swift test run

Fixes #7

[themartiano]

Wow, this is very welcome!

Please rebase, resolve the conflicts, and rerun the checks so I can merge.

[themartiano]

Since the conflicts are small, will fix myself so we can merge.

[themartiano]

Thanks for the pull request!

Codex comments

Resolved the conflicts with current main, preserving boot recovery and host-sleep handling. Full make test passed, including 211 Swift tests and the nested/fallback launch contracts; pinned upstream guest-source verification also passed. A diskless QEMU 11.1.1 smoke test confirmed the compatibility fallback on this host, which reports nested virtualization unavailable. GitHub CI is waiting for fork-workflow approval; local validation is complete. Ready to merge.