[Enrique Saurez (esaurez)]

Part of #1097.

What and why

SL2.2 puts what every launch shares in nvx::host::runtime::Runtime:
the OpenVMM, kernel and initramfs paths, their identity, the hypervisor,
an optional CPU profile, Windows job breakaway and LaunchOptions.
The options hold the guest shutdown action (Exit by default, Halt
or Reset) and the timeout for the host to authenticate to OpenVMM.
The boot console remains a per-VM setting.

RuntimeIdentity, ArtifactIdentity, IdentityPart and
MAX_IDENTITY_LEN move with their existing validation and serialization.
The store re-exports them for existing callers.

This intentionally removes the public
nvx::host::platform::probe_hypervisor path. Its replacement is
nvx::host::runtime::probe_hypervisor; the platform probes and their
failure classification do not change.

This also intentionally reclassifies the existing runtime-mismatch
code from ErrorKind::Other to the new ErrorKind::RuntimeMismatch.
That is a one-time alpha API change, not fully backward-compatible for
callers matching the old kind. The code's spelling, messages and CLI
exit status remain unchanged. Unsupported documents the malformed
values that existing identity checks already refuse. The error inventory
documentation no longer promises an ordering that this classification
would contradict; the actual inventory order is unchanged.

No artifact files are read or hashed by the new values. This change adds
no launch orchestration, CPU-profile parser or new hypervisor detection.
The options are values only; argument rendering and its validation are
not implemented here.

Public API

Both API snapshots add host::runtime and ErrorKind::RuntimeMismatch,
and replace the old public probe path with its runtime-owned path.
Existing store identity paths remain available. The implementation patch
is unchanged by the rebase onto the pinned qualification base.

Existing tests

• Kept, relocated unchanged: artifact_identities_are_printable_tokens
  and runtime_identities_bind_this_crates_contracts move from the store
  tests to the runtime tests with their existing assertions.
• Rewritten with expanded assertions: codes_determine_kinds checks
  the intentional mismatch-kind remapping, and
  every_kind_has_a_code_of_its_own_spelling covers the new kind and its
  conversions without changing the existing code spelling.
• Kept: the existing store, CLI, platform and runtime-adapter tests.
  No existing test is retired.
• Added: default shutdown behavior with a complete Runtime fixture,
  and the moved probe's classification and message on a foreign backend.

The inventory against the new base reports two modified existing tests,
two unchanged relocations and eight added test-code items, including helpers.
The tests-modified label is retained.

Validation

Qualified head: 98bb4a43863d321cdc696ce498ed476d88322107.
Pinned qualification base: 256ebe3dd9c23f20da94503b55d678d1193e392d.
Tree: ba9b8d99aa369dfd381a2ff59a22c03ad304214e.
OpenVMM source pin: 9cec2b89245f41f2126f9a787c5e43a0d84b7154.

All final qualifying commands ran at this head, and their test runners'
own summaries and counts were checked.

• Complete check-nvx-rs commands pass on Windows and Linux with Rust
  1.95.0 and MSRV 1.89, including every applicable runtime-adapter
  configuration, artifact bundling with staging enabled, and documentation.
  Linux also passes the API snapshots, macOS check, guest lint/tests,
  canonical guest build, manifest verification and static-ELF checks.
• Complete validate-nvx commands pass on both platforms. Windows uses
  native CPython 3.14.9 and Git's sh on PATH: 1,810 tests with 67
  platform skips, the complete 84-test adversarial module with 11
  platform skips, and four host-profile tests. The canceled-capture
  shell test ran successfully.
• Linux uses CPython 3.12.15: 1,810 tests with 30 platform skips,
  all 84 adversarial tests and four host-profile tests. Those three Python
  test commands ran in private process and mount namespaces with short
  temporary paths, so the process checks do not scan other test sessions.
• The complete Linux check-quality commands pass, including the 25
  Specula tests, shell lint/format and PowerShell syntax. This action is
  Linux-only in CI, not an additional Windows gate.
• OpenVMM's three protocol-vector comparisons and one CPU-profile
  comparison pass on both platforms. An independent read-only review of
  this exact head found no blocking issue.

The earlier failed and interrupted attempts remain recorded and are not
counted as passes. The Windows adversarial module and Linux CLI action
were rerun completely, not as focused exceptions. No test assertion or
timeout was relaxed.

No VM run is required for this value-only leaf: it changes no guest
implementation, VMM argument, CLI VM path or runtime-adapter source.
Guest code never constructs the added error kind. The guest binaries
were nevertheless rebuilt and checked against this candidate's source.
No VM, CI or hardware acceptance result is claimed.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the shared runtime configuration and API relocation.

No open issues 🎉

What changed in this PR

Implements SL2.2 of #1097 by introducing host::runtime as the home for shared launch configuration, preparing the host APIs for later VM lifecycle work without changing launch behavior.

Changes:

• Adds Runtime, LaunchOptions, and GuestPowerAction, with Exit as the default shutdown action.
• Moves runtime identities and hypervisor probing into the new module, preserving store identity re-exports while removing the old public probe path.
• Relocates identity tests, adds runtime defaults and probe coverage, and updates documentation and public API snapshots.

File	Description
nvx-rs/​src/​host/​store/​tests.rs	Removes identity tests relocated to the runtime module.
nvx-rs/​src/​host/​store/​mod.rs	Retains IdentityCheck and re-exports moved identity types.
nvx-rs/​src/​host/​runtime/​tests.rs	Houses identity tests and adds default-options and unavailable-hypervisor checks.
nvx-rs/​src/​host/​runtime/​mod.rs	Defines shared runtime configuration and houses identities and probing.
nvx-rs/​src/​host/​platform/​mod.rs	Removes the public probe wrapper moved to runtime.
nvx-rs/​src/​host/​mod.rs	Exposes and documents the runtime module.
nvx-rs/​src/​host/​artifacts/​mod.rs	Updates the documentation link to the relocated probe.
nvx-rs/​src/​contract.rs	Updates the documented runtime identity path.
nvx-rs/​README.md	Documents the runtime module and shared launch options.
nvx-rs/​public-api/​windows.txt	Records the new runtime API and relocated probe on Windows.
nvx-rs/​public-api/​linux.txt	Records the same API changes on Linux.

_{Review effort: Balanced}

[Enrique Saurez (esaurez)]

Scope update following the revised #1076/#1097 contract: SL2.1/#1267 is retired. New host APIs use the crate's Result, Error and ErrorKind, rather than the six per-domain error types.

This PR starts the value stack on dev, without #1267's commit. Add ErrorKind::RuntimeMismatch for the existing runtime-mismatch code, preserving its spelling, messages and CLI exit status. Existing functions keep their specified errors; code/constructor privatization belongs to #1126 later.

The base is being updated to dev; the branch still needs the corresponding adaptation. Keep the four value PRs in dependency order. Earlier validation remains evidence for its recorded head, not a pass for a revised branch. No Ready transition or manual CI dispatch is included.

[github-actions]

This pull request changes existing tests

It modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	fn codes_determine_kinds in error::tests	nvx-rs/src/error/tests.rs:22	nvx-rs/src/error/tests.rs:22
modified test	fn every_kind_has_a_code_of_its_own_spelling in error::tests	nvx-rs/src/error/tests.rs:39	nvx-rs/src/error/tests.rs:50

Relocated unchanged: 2; added: 8. Compared the merge base 256ebe3dd9c2 with 98bb4a43863d.

[Copilot]

🟢 Approval recommended

There are no active review issues for the change introducing reusable runtime launch inputs.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The shared VM launch-input refactor has no active review issues.

No open issues 🎉

_{Review effort: Balanced}