fix(libvirt): bind reproducible guest operations to fresh evidence

[doublewhy]

Plain-language summary

• Context: The libvirt backend builds a small guest boot environment and then checks evidence from that guest to confirm what actually ran.
• Problem: Those boot artifacts could vary with the host or build time, cached kernels could become stale, and a later operation could accidentally accept evidence left by an earlier guest. Memory and network checks also did not preserve enough exact information to justify certification.
• Fix: Build deterministic boot artifacts with explicit prerequisite checks, make kernel caching content-aware and atomic, issue a fresh challenge for every guest operation, reject stale evidence, preserve exact memory observations with an explicit tolerance, and bind service evidence to the requested protocol.

Issues closed

Closes #1094
Closes #1095
Closes #1105
Closes #1116

What changed

• Replaces host-dependent initramfs assembly with a deterministic repository-owned newc writer and fixed gzip metadata.
• Discovers and validates BusyBox explicitly, and fails with typed diagnostics before mutating libvirt state.
• Uses content validation and atomic replacement for the kernel cache.
• Generates a new cryptographic challenge per realization attempt and clears prior fact channels before boot.
• Rejects stale or mismatched guest reports and binds accepted evidence to the current operation.
• Records exact guest memory and applies a documented, configuration-bound tolerance.
• Validates service protocol and hardens generated init-script arguments.

Verification

• Full Python 3.12 unit suite: 6,490 passed, 1 skipped.
• Focused libvirt/artifact/evidence suite: 163 passed, 2 deselected.
• Changed production coverage: 439/439 executable lines and 114/114 branch exits.
• Ruff, repository policy, and static checks pass.
• Branch is based on current dev at 3d6e369b726607ff657a841c7f1dee0bec655b8f.

Scope

This PR is limited to the libvirt boot-artifact and guest-certification boundary. It does not include the separate OCI image-trust security change or the broader runtime scheduler/control-plane work.