feat(vm): add host bind mount support via virtiofs (libkrun)

[benoitf]

Summary

Add host directory bind mount support for libkrun VM sandboxes via the virtiofs4 API with simplified permission semantics. Operators enable the feature with enable_bind_mounts = true in [openshell.drivers.vm], and sandbox creators specify mounts in driver_config.mounts[].

note: it depends on a new release of kernel published at https://github.com/NVIDIA/OpenShell/actions/workflows/release-vm-kernel.yml for pre-built vm (with newer libkrun)

Related Issue

#2585

Changes

• Gateway config (openshell-gateway): Accept enable_bind_mounts in VmComputeConfig and forward as --enable-bind-mounts CLI flag to the VM driver subprocess
• FFI (openshell-driver-vm): Add krun_add_virtiofs4 binding (6-arg: ctx, tag, path, shm_size, read_only, semantics)
• Runtime (openshell-driver-vm): New VmMount type and add_virtiofs() method calling virtiofs4 with SEMANTICS_SIMPLIFIED
• Driver (openshell-driver-vm): VmMountConfig deserialization, path validation against reserved VM-internal directories, virtiofs tag generation, guest mount manifest injection into overlay disk, --vm-mount CLI arg forwarding
• Init script: mount_virtiofs_shares() reads /.openshell/mounts.manifest and mounts virtiofs shares at boot
• Kernel config: Enable CONFIG_FUSE_FS and CONFIG_VIRTIO_FS for guest virtiofs support
• Docs: Add enable_bind_mounts to gateway-config.mdx reference

Testing

• Unit tests for mount config deserialization (default read-write, explicit read-only)
• Unit tests for mount validation (requires enable_bind_mounts, rejects QEMU, rejects relative source, rejects file source, rejects reserved paths, rejects duplicates)
• Unit tests for --vm-mount CLI arg parsing
• Unit test for manifest tab-separated rendering
• Manual: create sandbox with driver_config.mounts and verify host directory is accessible in guest

Checklist

• Conventional commit format
• DCO sign-off
• Docs updated (gateway-config.mdx)
• No secrets or credentials committed
• mise run pre-commit passes
• mise run test passes

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.