[awf] Add live KVM conformance coverage for Cloud Hypervisor enclaves #9395

Goal

Provide supported-runner end-to-end evidence that the static Cloud Hypervisor enclave path preserves the existing enclave security, resource, output, and cleanup contract before preview enablement.

Shared contracts

• Test static script and static agent roles only; dynamic repository admission and custom enclave images remain unsupported.
• Use only the release-attested Cloud Hypervisor/enclave artifacts and existing guest protocol/closed role profiles. Do not add an unverified-artifact bypass to release or normal preview paths.
• Script writable storage has a 1 GiB aggregate invocation ceiling; agent writable storage has a 512 MiB aggregate ceiling, enforced by the host backing store (not a statfs-only or guest-only limit).
• Preserve broker protocol v2 and its host-owned authentication, bounded result, cancellation, settlement, and fail-closed behavior.
• Unsupported hosts or missing artifacts/prerequisites must be skipped or rejected only according to an explicit CI gate; they must not silently run a weaker runtime.

Scope

Add/extend a live test harness and supported GitHub-hosted Ubuntu x86_64 KVM CI job to exercise both enclave roles through the public broker invocation path. Check isolation properties and resource/lifecycle behavior without retaining repository-derived guest output in diagnostics. Keep deterministic non-KVM tests available for ordinary CI.

Acceptance criteria

• A successful bounded static script invocation and static agent invocation complete through the broker and return only schema-valid bounded results.
• Live assertions cover the role storage ceilings (ENOSPC), guest UID/GID and limits, script no-NIC networking, agent exact-peer/port network policy, read-only seed exposure, and denial of unrelated destinations/capabilities.
• Timeout, cancellation, guest failure/OOM, partial startup, and cleanup/recovery paths are exercised; no workload is automatically replayed after recovery.
• Tests assert that raw repository-derived stdout/stderr does not escape through logs or audit artifacts.
• Test artifacts contain only redacted diagnostics and are removed/retained according to the existing cleanup policy.
• Ordinary CI has deterministic tests for harness logic and assertions; privileged live execution is explicitly gated to eligible KVM runners.

Coordination contract

This issue owns conformance tests and CI coverage, not production runtime wiring or storage implementation. Author deterministic checks and the live harness in parallel using ADR 0002 and the contracts above; the full live path is ready to run when the broker/runtime wiring and bounded-storage issues land. Report each unmet assertion as a blocking gate rather than loosening it.

See ADR 0002 and Cloud Hypervisor architecture.