feat(det-init): guest pid-1 that detonates untrusted packages under a BPF-LSM observer - #983

… BPF-LSM observer

Adds `det-init`, the minimal-detonation guest `/init`. It embeds minimald's public
guest-boot library (`minimald::guest`) rather than forking minimald, then stands up
an in-guest BPF-LSM observer and runs an untrusted package install as `nobody`
under it, streaming the resulting event feed out for a host-side verdict.

It deliberately does NOT run minimald's SSH server: a detonation is one-shot, so
the sample is executed directly and the guest is discarded afterwards.

Boot sequence: mount, enter the rootfs, emit the READY vsock beacon early (minvmd
tears the guest down on a ~5s READY timeout), start the observer and wait for it to
signal readiness so no syscall is missed, route the sample's DNS through the
observer's collector, fire the deny-channel tripwire, drop privileges, run the
sample, then drain the observer and emit the feed.

Three properties are load-bearing for the trust model and each is self-checked at
boot:

  - the sample's stdio is NULLED, not inherited. The feed is emitted on the guest
    console and the host collects it by scanning for `{`-lines, so an inherited
    console would let `nobody` print forged events that the host accepts as real —
    voiding "a nobody sample cannot write the feed".
  - the binding nonce is readable only by root, proven by a leak-check that asserts
    `nobody` gets EPERM.
  - the event file is root-0400, proven by a uid-boundary self-check.

The sample is bounded by its own deadline, shorter than the host's VM timeout. The
feed is drained AFTER the sample returns, so an unbounded sample that never returns
would take the entire feed with it — the host reaps the VM, the drain never runs,
and a detonation that should have been BLOCK reports as an empty capture. That is
not an exotic input: a poisoned package whose C2 is unreachable blocks on connect()
exactly like this, so the better the network defense, the more likely the whole
feed is lost. On expiry the sample is SIGKILLed and the events it already produced
are drained normally.

Verified on Linux (`cargo check -p det-init --locked`, rustc 1.97.0) and by live
detonation on x86_64/KVM: 16/16 LSM hooks and 3/3 tracepoints attach, a clean npm
install verdicts PASS, and a poisoned sample reading honeytokens and beaconing to a
non-registry host verdicts BLOCK.

Refs gominimal/minimal-detonation#194, gominimal/minimal-detonation#272