feat: Add systemd socket activation for dstack-guest-agent

[kvinwang]

Summary

• Replace systemd-socket-proxyd with native socket activation support
• Eliminate proxy layer for lower complexity
• Sockets survive service restarts, maintaining compatibility with containers that mount sockets directly
• Use canonical /run path instead of legacy /var/run

Changes

• Add dstack-guest-agent.socket with both sockets (dstack.sock at index 0, tappd.sock at index 1)
• Remove dstack-socket.{socket,service} and tappd-socket.{socket,service}
• Add listenfd dependency for receiving sockets from systemd
• Add ActivatedUnixListener wrapper implementing rocket's Listener trait
• Modify run_internal/run_internal_v0 to use activated sockets when available, with fallback
• Update dstack-guest-agent.service to require the socket unit
• Fix socket paths: /var/run → /run (eliminates systemd warning)

Test plan

• Build and deploy to test VM
• Verify sockets are created by systemd before service starts
• Verify service accepts connections on both sockets
• Verify containers with mounted sockets continue to work after service restart
• Verify no legacy /var/run warning in boot logs
• Verify /var/run/dstack.sock backward compatibility (symlink)

Test Results (TDX enabled on teepod2.kvin.wang)

Socket Activation

$ systemctl status dstack-guest-agent.socket
● dstack-guest-agent.socket - Socket for dstack-guest-agent
     Loaded: loaded
     Active: active (running)
     Listen: /run/dstack.sock (Stream)
             /run/tappd.sock (Stream)

$ ls -la /run/*.sock
srwxrwxrwx    1 root     root     /run/dstack.sock
srwxrwxrwx    1 root     root     /run/tappd.sock

No /var/run Warning

Boot logs show no warnings about legacy /var/run path.

Socket Persistence After Restart

# Container mounts socket
docker run -d -v /run/dstack.sock:/run/dstack.sock busybox sleep infinity

# Before restart - works
docker exec <container> wget -q -O- --unix-socket /run/dstack.sock http://localhost/
# Returns 404 (expected - no matching route)

# Restart guest-agent
systemctl restart dstack-guest-agent

# After restart - still works!
docker exec <container> wget -q -O- --unix-socket /run/dstack.sock http://localhost/
# Returns 404 (socket still functional)

/var/run Backward Compatibility

# /var/run is symlink to /run
$ ls -la /var/run
lrwxrwxrwx    1 root     root     6 /var/run -> ../run

# Container mounting /var/run/dstack.sock works
docker run -d -v /var/run/dstack.sock:/var/run/dstack.sock busybox sleep infinity
docker exec <container> wget -q -O- --unix-socket /var/run/dstack.sock http://localhost/
# Returns 404 - socket accessible via legacy path