fix(libvirt): bind guest service protocol into admission and evidence

[doublewhy]

Problem

Guest-certified libvirt realization admits ServiceSpec.protocol=udp, but the appliance always launches a TCP listener and the guest report omits protocol. A UDP request can therefore be reported as successfully realized by TCP behavior.

This is a fail-open certification defect under RUN-314 / ASR-519 and blocks the final guest-certification acceptance in #717.

Decision boundary

Until a UDP-native guest implementation and probe exist, guest-certified mode must reject every protocol other than normalized tcp. The admitted protocol must remain present in the runtime-domain payload, boot placement, guest listener check, parsed fact, expected projection, and realization observation. A protocol mismatch must fail certification.

This does not change daemon-only TechVault behavior or claim UDP support.

Acceptance

• UDP and unknown/malformed protocol requests receive the stable service-unsupported diagnostic before native mutation.
• TCP/default-TCP placement launches and checks only a TCP listener.
• Guest service facts and observations bind name, protocol, port, listener state, and process state.
• Wrong/missing protocol evidence fails certification.
• Focused positive/negative tests cover admission, artifact content, fact parsing, observation comparison, and no-network-mutation ordering.

Requirement: RUN-314. Assurance: ASR-519. Related: #714, #717.

[doublewhy]

Implemented and verified in merged PR #1128. Closing manually because the PR merged into the dev branch, while GitHub auto-closes linked issues only when changes reach the default branch.