Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/agent.go

@@ -10,17 +10,17 @@ import (
 
 // AgentConfig is the configuration for the mcp-agent daemon.
 type AgentConfig struct {
-	Server    ServerConfig    `toml:"server"`
-	Database  DatabaseConfig  `toml:"database"`
-	MCIAS     MCIASConfig     `toml:"mcias"`
-	Agent     AgentSettings   `toml:"agent"`
-	MCProxy   MCProxyConfig   `toml:"mcproxy"`
-	Metacrypt MetacryptConfig `toml:"metacrypt"`
-	MCNS      MCNSConfig      `toml:"mcns"`
-	Monitor   MonitorConfig   `toml:"monitor"`
-	Log       LogConfig       `toml:"log"`
-	Boot   BootConfig        `toml:"boot"`
-	Master AgentMasterConfig `toml:"master"`
+	Server    ServerConfig      `toml:"server"`
+	Database  DatabaseConfig    `toml:"database"`
+	MCIAS     MCIASConfig       `toml:"mcias"`
+	Agent     AgentSettings     `toml:"agent"`
+	MCProxy   MCProxyConfig     `toml:"mcproxy"`
+	Metacrypt MetacryptConfig   `toml:"metacrypt"`
+	MCNS      MCNSConfig        `toml:"mcns"`
+	Monitor   MonitorConfig     `toml:"monitor"`
+	Log       LogConfig         `toml:"log"`
+	Boot      BootConfig        `toml:"boot"`
+	Master    AgentMasterConfig `toml:"master"`
 }
 
 // AgentMasterConfig holds the optional master connection settings.