feat(justfile): present CI's testable surfaces as just recipes (remove dep on previous minimal shim) - #787

The bare-name pkill killed collateral: another checkout's live VM, or
podman's gvproxy. Persistent leftovers all carry the absolute repo
path in their cmdline (minvmd's supervisor and __krun-vmm re-exec via
current_exe(); gvproxy is spawned from the full MINVMD_GVPROXY_BIN
path), so anchor the patterns to the script's own repo root.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The checkouts crate's tests shell out to `git init -b`, which needs
git >= 2.28; the cross image's Ubuntu 20.04 base ships 2.25 and CI
runners have a modern git natively, so `just test-cross` was the first
context to hit it. Pull git from the git-core PPA, noninteractively
(the PPA install drags in tzdata, which otherwise prompts and wedges
the image build).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CONTRIBUTING's pre-PR block becomes `just ci`, and both test-extension
contract tables (CONTRIBUTING.md and ci-strategy §10) get the recipe
names in their local-command column. The manual run-the-harness-binary
fallback now states the env it needs (MINVMD_E2E=1, the MINVMD_*
paths, --include-ignored) — without it every test self-skips green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

minimald can reset the very first SSH connect right after binding its
socket, which trips the CLI's autospawn and failed the recipe even
though the daemon was healthy. Use the same 5x2s retry loop dm3
already has. Verified cold and warm on a Linux host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

On slower Linux hosts (nested KVM) the generic guest kernel spends
40-70s probing hardware before pid-1 starts, overrunning the
supervisor's 60s READY default and the CLI autospawn's 75s wait —
the e2e's post-stop respawn proof then fails on a healthy stack.
Export the same 150s headroom the dm3 recipe already carries, caller-
overridable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

minvmd-lifecycle.sh hardcoded `run --detach --timeout 30` and a ~15s
Running poll; CI's guests boot well inside both, slower dev hosts
(nested KVM) do not. One env knob, MINVMD_LIFECYCLE_BOOT_TIMEOUT_SECS
(default 30, so CI is unchanged), now drives both waits, and the
test-lifecycle recipe exports 150 on Linux alongside the matching
supervisor READY headroom.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

e2e-native's userns preflight told the user to flip
kernel.apparmor_restrict_unprivileged_userns=0 host-wide. Advise the
per-binary profile the installer ships instead, in the installer's own
wording (sudo scripts/install-apparmor-profile.sh --path
target/debug/minimald), and treat "profile installed + tunables name
this checkout's binary" as remediated — the sysctl stays 1 in that
case, so it alone cannot be the gate. The build now precedes the
preflight so the advised --path target exists.

dm2 gets a warn-only twin: the daemon runs fine restricted, but every
activate sandbox dies at uid_map until the profile is in.

test-root-integration keeps its sysctl hint: its namespaces are created
by hashed-path test binaries and /usr/bin/unshare, which a
path-attached profile cannot cover.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

session-e2e.sh parked its state dir on /tmp while deliberately reusing
the host package cache — but minimald hardlinks built packages from the
cache into each session rootfs under the state dir, and hardlinks
cannot cross filesystems. On hosts with a tmpfs /tmp (Fedora's default;
common elsewhere) every native (DM2) session died at spawn with EXDEV;
CI runners keep /tmp on the root disk, which is why the lane never saw
it.

On Linux the workdir now lives under $HOME — same device as the cache,
the assumption production's ~/.local/state already makes — and doubles
as the state root: the spare /state hop plus a shorter native seed
template keep the deepest per-task socket
(tasks/<seed>-<ts>-<n>-<pid>/run/minenv_sock) inside the 108-byte
sun_path budget. macOS keeps its /tmp layout (104-byte limit, VM-backed
lanes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Collapse the per-recipe `case $(uname -s)` dispatch into [linux]/[macos]
recipe attributes, hoist the repeated MINVMD_*/PATH/timeout exports to
top-level `export`, and dedupe the kvm/userns preflights and the
first-connect retry into shared helpers. Rename the deployment-model
recipes to plain verbs: dm1/dm2 fold into the per-OS `up`, dm3 becomes
`up-kvm`, dm2-down becomes `down` (macOS `down` delegates to `stop`).
Drop the unreferenced codesign-minvmd release recipe and test-vm's unused
gvproxy fetch; resolve the macOS shim by install path so a stale
target/debug binary can't shadow it. Comments cut to captions plus
landmines; session-e2e.sh drops its DM parentheticals and
docs/ci-strategy.md points at up/up-kvm.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sudo -n fails fast without passwordless sudo and || true swallowed it,
so the documented user-owned fallback never ran. Kill as the invoking
user first, then escalate for root-owned relay leftovers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The per-commit package map (buildbot's commit_index) only exists for
pkgs commits built since the writer landed; the old pin predates it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…he index

fetch-prebuilt.sh resolves kernel/rootfs/krun through the package map
buildbot publishes per pkgs commit (arch -> package -> sha256) and pulls
the content-addressed zstd tarballs directly — no toolchain, no graph
evaluation, and no macOS shim. The justfile's artifacts recipe collapses
to one OS-agnostic definition and libkrun fetches prebuilt too; the
mip-based fetch scripts remain for the frozen CI lanes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The index sha256 is the content address — check the downloaded bytes
against it (and reject malformed digests) before extraction, and rename
file artifacts into place so an interrupted run can't leave a partial
kernel/rootfs that the -f guards would trust forever.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>