Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/agent/status.go

@@ -15,8 +15,9 @@ import (
 // ServiceInfo message.
 func buildServiceInfo(svc registry.Service, components []registry.Component) *mcpv1.ServiceInfo {
 	info := &mcpv1.ServiceInfo{
-		Name:   svc.Name,
-		Active: svc.Active,
+		Name:    svc.Name,
+		Active:  svc.Active,
+		Comment: svc.Comment,
 	}
 	for _, c := range components {
 		info.Components = append(info.Components, &mcpv1.ComponentInfo{
@@ -56,7 +57,7 @@ func (a *Agent) ListServices(ctx context.Context, req *mcpv1.ListServicesRequest
 // registry. It returns a list of ServiceInfo messages with updated observed
 // state. This shared logic is used by both LiveCheck and GetServiceStatus.
 func (a *Agent) liveCheckServices(ctx context.Context) ([]*mcpv1.ServiceInfo, error) {
-	containers, err := a.Runtime.List(ctx)
+	containers, err := a.listAllContainers(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("runtime list: %w", err)
 	}
@@ -84,8 +85,9 @@ func (a *Agent) liveCheckServices(ctx context.Context) ([]*mcpv1.ServiceInfo, er
 		}
 
 		info := &mcpv1.ServiceInfo{
-			Name:   svc.Name,
-			Active: svc.Active,
+			Name:    svc.Name,
+			Active:  svc.Active,
+			Comment: svc.Comment,
 		}
 
 		for _, comp := range components {