Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/agent/heartbeat.go

@@ -21,8 +21,8 @@ import (
 // MasterConfig holds the optional master connection settings for the agent.
 // When configured, the agent self-registers and sends periodic heartbeats.
 type MasterConfig struct {
-	Address   string `toml:"address"`   // master gRPC address
-	CACert    string `toml:"ca_cert"`   // CA cert to verify master's TLS
+	Address   string `toml:"address"`    // master gRPC address
+	CACert    string `toml:"ca_cert"`    // CA cert to verify master's TLS
 	TokenPath string `toml:"token_path"` // MCIAS service token for auth
 }
 
@@ -38,12 +38,20 @@ type HeartbeatClient struct {
 	interval time.Duration
 	stop     chan struct{}
 	wg       sync.WaitGroup
-	logger   interface{ Info(string, ...any); Warn(string, ...any); Error(string, ...any) }
+	logger   interface {
+		Info(string, ...any)
+		Warn(string, ...any)
+		Error(string, ...any)
+	}
 }
 
 // NewHeartbeatClient creates a client that registers with the master and
 // sends periodic heartbeats. Returns nil if master address is not configured.
-func NewHeartbeatClient(cfg config.AgentConfig, logger interface{ Info(string, ...any); Warn(string, ...any); Error(string, ...any) }) (*HeartbeatClient, error) {
+func NewHeartbeatClient(cfg config.AgentConfig, logger interface {
+	Info(string, ...any)
+	Warn(string, ...any)
+	Error(string, ...any)
+}) (*HeartbeatClient, error) {
 	// Config takes precedence, env vars as fallback.
 	masterAddr := cfg.Master.Address
 	if masterAddr == "" {