Validate selected-harness observations in live Cloud Hypervisor guests #11091

Parent and priority

Bounded validation child of Phase 4 #10294, under #10290. User-directed order: Cloud Hypervisor and NVX before Docker/ARC-DinD live acceptance. Docker implementation #11072 is merged; #11068 remains open for its acceptance evidence. This issue concerns the existing Cloud Hypervisor primary-guest observation producer from #11057/#11064, not a new producer or enclave support.

Evidence gap

The existing Cloud Hypervisor producer uses the ready manager execution channel with command-matching guest UID/GID, environment, cwd and login shell. Probe bounds, sanitized parsing, environment binding, report publication, eligibility and immutable request/routing pins have deterministic coverage. That does not establish live KVM guest compatibility or prove this new observation-to-command path ran in an actual guest.

Scope

Use the same bounded fixture-based acceptance approach as Docker, adapted to the existing Cloud Hypervisor backend and KVM test infrastructure. Exercise the real compiled producer/lifecycle with deterministic Copilot/Claude/Codex fixture executables rather than live provider inference. Reuse existing test harnesses and ordinary CI where suitable. Verify guest evidence rather than substituting a host executable/version.

Acceptance criteria

• A real supported Linux x86_64/KVM Cloud Hypervisor primary guest resolves and probes the directly selected fixture harness before the command executes; canonical harness/environment binding and sanitized version report are asserted.
• Guest identity, env/PATH/login-shell and cwd semantics match the subsequent command. Observations from the host, a different run/environment/harness or the primary agent for an enclave do not qualify.
• Matching test-owned requirements admit the command, and applicable incompatible/unverified requirements prevent its execution with sanitized actionable reasons. Unconstrained legacy admission is not represented as verified compatibility. Test constraints must not become production catalogue facts or enable feed constraints.
• Missing/malformed/failed/oversized/timed-out probes and startup/cancellation/cleanup paths are covered with explicit evidence; verify the existing 10-second/4096-byte bounds and no stderr/credential/raw-error leakage.
• Report publication and immutable eligibility/request/routing observation pinning are exercised at the appropriate real-consumer boundary, without mutating in-flight decisions.
• Real guest run evidence is recorded separately from deterministic test results, including exact tested revision and environment. Unavailable KVM/artifacts/runner infrastructure is a blocker, not a pass or a reason to close this issue.
• Necessary test/fixture/lifecycle corrections and directly related documentation are included in a bounded change with existing targeted validation and packaging checks as applicable.

Non-goals

No provider inference, sbx support, Docker/ARC-DinD acceptance work, NVX producer work, per-invocation enclave/opaque/session attribution, compiler/overlay protocol changes, immutable executable attestation or new execution-security architecture. Keep production bundled harness constraints empty and feed constraints rejected as catalogue_harness_unsupported. Preserve policy/network/feature/effort/known-limit controls, pricing non-admission and bounded recovery/opt-outs. Supported product targets remain cloud-hypervisor, nvx, docker and arc/dind only. Broader phases remain open.