Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/agent/recover.go

@@ -22,7 +22,7 @@ func (a *Agent) Recover(ctx context.Context) error {
 	}
 
 	// Get the list of currently running containers from podman.
-	running, err := a.Runtime.List(ctx)
+	running, err := a.listAllContainers(ctx)
 	if err != nil {
 		a.Logger.Warn("cannot list containers, assuming none running", "err", err)
 		running = nil
@@ -67,18 +67,22 @@ func (a *Agent) Recover(ctx context.Context) error {
 				"image", comp.Image,
 			)
 
+			rt := a.runtimeFor(comp.Runtime)
+
 			// Remove any stale container with the same name.
-			_ = a.Runtime.Remove(ctx, containerName)
+			_ = rt.Remove(ctx, containerName)
 
 			// Build the container spec from the registry.
 			spec := runtime.ContainerSpec{
-				Name:    containerName,
-				Image:   comp.Image,
-				Network: comp.Network,
-				User:    comp.UserSpec,
-				Restart: comp.Restart,
-				Volumes: comp.Volumes,
-				Cmd:     comp.Cmd,
+				Name:     containerName,
+				Image:    comp.Image,
+				Network:  comp.Network,
+				User:     comp.UserSpec,
+				Restart:  comp.Restart,
+				Volumes:  comp.Volumes,
+				Cmd:      comp.Cmd,
+				MemoryMB: comp.MemoryMB,
+				VCPUs:    comp.VCPUs,
 			}
 
 			// Allocate ports from routes if the component has routes.
@@ -95,7 +99,7 @@ func (a *Agent) Recover(ctx context.Context) error {
 				spec.Ports = comp.Ports
 			}
 
-			if err := a.Runtime.Run(ctx, spec); err != nil {
+			if err := rt.Run(ctx, spec); err != nil {
 				a.Logger.Error("recover container failed",
 					"container", containerName,
 					"err", err,