feat(isolation): prototype BlueField VM fence evidence

[drew]

Summary

Prototype the confirmation contract for a BlueField-accelerated VM without weakening the ordinary NIC-less VM boundary. The new evidence model permits one guest VF only when a generation-bound DPU fence proves default-deny behavior, authorized flow installation, revocation, and fail-closed controller loss.

This PR defines and tests the contract only. It does not attach a VF, program BlueField hardware, or make the mode selectable.

Related Issue

Related to #3361.

Stacked on #3367; review and merge #3366 and #3367 first. This prototype was directly requested; there is not yet a dedicated accepted BlueField implementation issue.

Changes

• Add a distinct BluefieldVm driver fence that binds the VF PCI address, representor, DPU identity, assignment generation, and policy generation to the sandbox launch.
• Require exactly one attached VF, no unmanaged guest network devices, and a default-deny DPU policy while preserving the existing NIC-less generic VM fence.
• Add backend-owned BlueField audit evidence for authorization, revocation, and controller-loss round trips, then project it into the backend-neutral boundary properties introduced by refactor(isolation): make confirmation backend-neutral #3366.
• Add positive and fail-closed conformance tests for mismatched generations, missing default deny, wrong fence types, and controller loss.
• Document the contract and explicitly deferred runtime and hardware integration.

Testing

• mise run pre-commit passes
• Unit tests added/updated
  • cargo test -p openshell-isolation-interface --test backend_conformance
  • cargo test -p openshell-sandbox-backend boundary_protocol::tests
• cargo clippy -p openshell-isolation-interface -p openshell-sandbox-backend --all-targets -- -D warnings
• E2E tests not applicable: no driver or runtime selects this contract yet

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.