Add unikernel runtime: run services as Nanos VMs under QEMU/KVM

Implements the hypervisor design's Phase 1: a second runtime.Runtime
backend (QEMU) that runs each service component as a Nanos unikernel VM
instead of a podman container, selected per-component via a new
runtime = "unikernel" service-def field.

- internal/runtime/qemu.go: QEMURuntime. Pull extracts the ELF from the
  OCI image; Run does `ops build` + boots qemu-system-x86_64 with KVM,
  user-mode net port-forwards, QMP control socket and serial console log;
  Stop/Remove/Inspect/List/Logs map onto VM lifecycle + state dir.
- proto/registry/servicedef: add runtime, memory_mb, vcpus fields
  (registry migration 5).
- agent: holds both runtimes; runtimeFor() selects per component;
  listAllContainers() merges containers + VMs so drift/status see both.
  Unikernel runtime auto-enables on nodes with /dev/kvm + ops.

Validated end-to-end on straylight: a test service deploys via
`mcp deploy --direct`, boots as a Nanos unikernel, serves HTTP through
the agent port-forward, and reports running via `mcp status`/`mcp logs`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/runtime/qemu_test.go

@@ -0,0 +1,43 @@
+package runtime
+
+import "testing"
+
+func TestSanitizeImage(t *testing.T) {
+	got := sanitizeImage("mcr.example:8443/mcdoc:v0.1.0")
+	if got != "mcr.example_8443_mcdoc_v0.1.0" {
+		t.Errorf("sanitizeImage = %q", got)
+	}
+}
+
+func TestBinaryName(t *testing.T) {
+	cases := map[string]string{
+		"host:8443/mcdoc:v0.1.0": "mcdoc",
+		"mcdoc:v1":               "mcdoc",
+		"reg/uktest":             "uktest",
+	}
+	for in, want := range cases {
+		if got := binaryName(in); got != want {
+			t.Errorf("binaryName(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestHostForward(t *testing.T) {
+	cases := map[string]string{
+		"100.88.197.9:18080:8080": "tcp:100.88.197.9:18080-:8080",
+		"18080:8080":              "tcp:127.0.0.1:18080-:8080",
+		"8080":                    "tcp:127.0.0.1:8080-:8080",
+	}
+	for in, want := range cases {
+		if got := hostForward(in); got != want {
+			t.Errorf("hostForward(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestGuestPorts(t *testing.T) {
+	got := guestPorts([]string{"100.88.197.9:18080:8080", "9090"})
+	if len(got) != 2 || got[0] != "8080" || got[1] != "9090" {
+		t.Errorf("guestPorts = %v", got)
+	}
+}