Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/agent/agent.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 
 	mcpv1 "git.wntrmute.dev/mc/mcp/gen/mcp/v1"
@@ -28,7 +29,8 @@ type Agent struct {
 
 	Config    *config.AgentConfig
 	DB        *sql.DB
-	Runtime   runtime.Runtime
+	Runtime   runtime.Runtime // container runtime (podman)
+	Unikernel runtime.Runtime // unikernel runtime (qemu/nanos); nil if unavailable
 	Monitor   *monitor.Monitor
 	Logger    *slog.Logger
 	PortAlloc *PortAllocator
@@ -53,6 +55,18 @@ func Run(cfg *config.AgentConfig, version string) error {
 
 	rt := &runtime.Podman{}
 
+	// The unikernel runtime is enabled only on nodes with KVM. Services with
+	// runtime = "unikernel" are placed by the master on KVM-capable nodes.
+	var uk runtime.Runtime
+	if unikernelSupported() {
+		uk = &runtime.QEMU{
+			ImageDir: filepath.Join(homeDir(cfg), "images"),
+			StateDir: filepath.Join(homeDir(cfg), "vm"),
+			HomeDir:  homeDir(cfg),
+		}
+		logger.Info("unikernel runtime enabled (KVM detected)")
+	}
+
 	mon := monitor.New(db, rt, cfg.Monitor, cfg.Agent.NodeName, logger)
 
 	proxy, err := NewProxyRouter(cfg.MCProxy.Socket, cfg.MCProxy.CertDir, logger)
@@ -74,6 +88,7 @@ func Run(cfg *config.AgentConfig, version string) error {
 		Config:    cfg,
 		DB:        db,
 		Runtime:   rt,
+		Unikernel: uk,
 		Monitor:   mon,
 		Logger:    logger,
 		PortAlloc: NewPortAllocator(),