Summary

Add reusable Nix and QEMU infrastructure for running OpenShell tests in disposable Linux VMs. The harness provides pinned native-architecture cloud guests, composable runtime and security configurations, artifact installation, predictable cleanup, and retained diagnostics for failures.

This is the base infrastructure PR for the VM-backed release and E2E test integrations in the child PRs below.

Stack

This is the parent PR.

• ci(release): run Linux release canaries in QEMU VMs #2472 — run Linux release canaries in QEMU VMs
• test(e2e): add VM-backed E2E suite runner #2473 — run E2E suites through the QEMU VM infrastructure

Related Issue

Prototype alternative to #2254.

Changes

• Add pinned Ubuntu 24.04, Fedora 44, CentOS Stream 10, and Rocky Linux 9 cloud-image definitions for ARM64 and AMD64
• Add a nix run .#test-vm interface with disposable QCOW2 overlays, cloud-init SSH bootstrap, hardware acceleration where available, cleanup, and retained debug state
• Add composable Ansible configurations for Docker, rootless Podman, and SELinux enforcing mode
• Support repeatable package installation and direct executable copying into guests
• Add automatic KVM-to-TCG fallback for Linux hosts without accessible hardware virtualization
• Add dpkg to the Nix development shell and keep Debian package creation artifact-only
• Document requirements, supported combinations, package workflows, lifecycle, and current limitations

Testing

• bash -n nix/vm/run.sh tasks/scripts/package-deb.sh
• shellcheck nix/vm/run.sh tasks/scripts/package-deb.sh
• Parsed all Ansible playbooks as YAML
• nix fmt reports no changes
• Evaluated the flake app for aarch64-darwin, aarch64-linux, and x86_64-linux
• CentOS Stream 10: installed rootless Podman and verified SELinux enforcing
• Rocky Linux 9: installed Docker and verified SELinux enforcing
• Fedora 44 ARM64: installed the release RPMs and reached the Podman-backed gateway with SELinux enforcing
• Ubuntu 24.04 ARM64: installed the release Debian package and reached the Docker-backed gateway
• mise run pre-commit passes
• Unit tests added/updated (not applicable to this test infrastructure)
• Automated E2E integration is added in the stacked child PRs

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture and VM usage documentation updated