feat: implement a runnable Cloud Hypervisor v53.0 microVM backend (stack layer 3)

CLAUDE.md

@@ -47,7 +47,7 @@ The system is orchestrated by `src/cli.ts` and managed by `src/docker-manager.ts
 - **[docs/releasing.md](docs/releasing.md)** - Release process and versioning instructions
 - **[docs/INTEGRATION-TESTS.md](docs/INTEGRATION-TESTS.md)** - Integration test coverage guide with gap analysis
 - **[docs/enclaves-architecture.md](docs/enclaves-architecture.md)** - Unified enclave architecture, MCP gateway handoff, migration, and coverage notes
-- **[docs/cloud-hypervisor-foundation.md](docs/cloud-hypervisor-foundation.md)** - Cloud Hypervisor microVM foundation (config/artifacts/preflight only; not yet a runnable backend)
+- **[docs/cloud-hypervisor-foundation.md](docs/cloud-hypervisor-foundation.md)** - Cloud Hypervisor v53.0 microVM backend (preview): REST API client, secure launcher (network-namespace join + privilege drop + Landlock/seccomp in place of a jailer), manager/backend, GitHub-hosted Ubuntu x86_64 KVM runners only
 
 ## Development Workflow
 

README.md

@@ -95,7 +95,7 @@ See [GitHub Actions](docs/github_actions.md) for advanced setup and `awf logs su
 - [Auth Doctor Updater workflow](.github/workflows/auth-doctor-updater.md) — daily/manual audit that opens bounded PRs with evidence-backed authentication and API-proxy documentation corrections
 - [Image verification](docs/image-verification.md) — cosign signature verification
 - [Firecracker integration (preview)](docs/firecracker-integration.md) — Firecracker v1.16.1 microVM backend: explicit opt-in, Linux/KVM only, macOS/Windows unsupported, operator-managed artifacts with mandatory SHA-256 digests, fail-closed egress, mandatory API proxy credential isolation
-- [Cloud Hypervisor foundation](docs/cloud-hypervisor-foundation.md) — config/artifact plumbing, preflight validation, and guest artifact pipeline for a future Cloud Hypervisor microVM backend; **not yet a runnable runtime**
+- [Cloud Hypervisor integration (preview)](docs/cloud-hypervisor-foundation.md) — Cloud Hypervisor v53.0 microVM backend: explicit opt-in, GitHub-hosted Ubuntu x86_64 KVM runners only, operator-managed artifacts with mandatory SHA-256 digests, Landlock/seccomp-confined launcher in place of a jailer, fail-closed egress, mandatory API proxy credential isolation
 
 ## Development
 

docs/awf-config-spec.md

@@ -76,7 +76,7 @@ following top-level properties. All are OPTIONAL:
 | `security` | object | Security and isolation settings |
 | `container` | object | Container and Docker settings |
 | `firecracker` | object | Firecracker v1.16.1 control-plane preview settings |
-| `cloudHypervisor` | object | Cloud Hypervisor v53.0 foundation settings (artifacts/digests only; no lifecycle backend yet — see §4.1) |
+| `cloudHypervisor` | object | Cloud Hypervisor v53.0 microVM preview settings (see §4.1) |
 | `chroot` | object | Chroot execution overrides for split-filesystem ARC/DinD runners |
 | `dind` | object | Bootstrap helpers for ARC/DinD split runner/daemon filesystems |
 | `runner` | object | Runner topology declaration (standard vs. ARC/DinD) |
@@ -89,20 +89,27 @@ following top-level properties. All are OPTIONAL:
 Property-level constraints, types, and descriptions are defined
 normatively by `docs/awf-config.schema.json`.
 
-### 4.1 Cloud Hypervisor foundation (not yet a runnable backend)
+### 4.1 Cloud Hypervisor microVM preview
 
 The `cloudHypervisor` surface pins Cloud Hypervisor v53.0 artifacts and
 digests (binary, PCI-capable guest kernel, rootfs, and the shared AWF guest
-supervisor) so a config document can be prepared and round-tripped ahead of
-time. **It has no lifecycle backend in this release**: `cloud-hypervisor` is
-not a valid `container.containerRuntime` value, and supplying
-`cloudHypervisor` options does not execute any workload. Supported host
-target is GitHub-hosted Ubuntu `x86_64` runners with KVM only; self-hosted
-and non-Ubuntu/non-x86_64 hosts are out of scope. See
+supervisor) and, like Firecracker, requires explicit
+`--cloud-hypervisor-preview` opt-in plus `container.containerRuntime:
+"cloud-hypervisor"` to execute a workload. Supported host target is
+GitHub-hosted Ubuntu `x86_64` runners with KVM only — self-hosted and
+non-Ubuntu/non-x86_64 hosts are rejected explicitly by
+[`src/cloud-hypervisor/host-eligibility.ts`](../src/cloud-hypervisor/host-eligibility.ts),
+unlike Firecracker's preview which permits self-hosted hosts. See
 [`src/cloud-hypervisor/preflight.ts`](../src/cloud-hypervisor/preflight.ts)
-for the artifact/host trust-check module and
-[`guest/cloud-hypervisor/`](../guest/cloud-hypervisor/) for the guest
-artifact build/verification pipeline.
+for the artifact/host trust-check module,
+[`src/cloud-hypervisor/launcher.ts`](../src/cloud-hypervisor/launcher.ts)
+for the secure host launcher (network-namespace join, privilege drop, and
+Landlock-based filesystem confinement in place of Firecracker's jailer),
+[`src/cloud-hypervisor/manager.ts`](../src/cloud-hypervisor/manager.ts) for
+the VM lifecycle, and [`guest/cloud-hypervisor/`](../guest/cloud-hypervisor/)
+for the guest artifact build/verification pipeline. See
+[docs/cloud-hypervisor-foundation.md](./cloud-hypervisor-foundation.md) for
+the full architecture and security-boundary writeup.
 
 ## 5. CLI Mapping
 
@@ -220,7 +227,7 @@ AWF settings MAY be supplied via config files, including stdin (`--config -`).
 - `firecracker.sha256.kernel` → `--firecracker-kernel-sha256`
 - `firecracker.sha256.rootfs` → `--firecracker-rootfs-sha256`
 - `firecracker.sha256.supervisor` → `--firecracker-supervisor-sha256`
-- `cloudHypervisor.previewEnabled` → `--cloud-hypervisor-preview` *(foundation only; does not enable workload execution)*
+- `cloudHypervisor.previewEnabled` → `--cloud-hypervisor-preview` *(requires `container.containerRuntime: "cloud-hypervisor"` and a GitHub-hosted Ubuntu x86_64 KVM runner to execute a workload)*
 - `cloudHypervisor.cloudHypervisorBinary` → `--cloud-hypervisor-binary`
 - `cloudHypervisor.kernelPath` → `--cloud-hypervisor-kernel`
 - `cloudHypervisor.rootfsPath` → `--cloud-hypervisor-rootfs`

docs/awf-config.schema.json

@@ -730,13 +730,13 @@
     },
     "cloudHypervisor": {
       "type": "object",
-      "description": "Cloud Hypervisor v53.0 foundation configuration (artifacts and digests only). There is no lifecycle backend yet: this cannot be selected via container.containerRuntime and cannot execute workloads.",
+      "description": "Cloud Hypervisor v53.0 microVM preview configuration. Requires container.containerRuntime: \"cloud-hypervisor\" and previewEnabled to execute workloads; supported only on GitHub-hosted Ubuntu x86_64 KVM runners.",
       "additionalProperties": false,
       "properties": {
         "previewEnabled": {
           "type": "boolean",
           "default": false,
-          "description": "Reserve Cloud Hypervisor configuration for a future preview. Has no effect on workload execution in this release."
+          "description": "Enable the Cloud Hypervisor v53.0 workload-execution preview. Requires container.containerRuntime: \"cloud-hypervisor\" and a GitHub-hosted Ubuntu x86_64 KVM runner."
         },
         "cloudHypervisorBinary": {
           "type": "string",