init: add a control server for exec and signal delivery

Container runtimes built on libkrun have no way to reach a process inside a running guest. As a result podman exec and health checks fail for krun containers, and podman stop can only kill the VMM, so the workload never sees SIGTERM.

Add an opt-in control server to krun-init, as discussed in #905. It runs on a thread, accepts connections from the host CID only, and serves two requests: start a process with the given argv, environment, cwd, user and optional pty, relaying its stdio, window size and signals until it exits; and deliver a signal to the workload. The protocol lives in a new krun-init-common crate (serde over bincode) and stays private to libkrun. Callers use Builder::control_socket() and Config::apply_with_vsock(), which maps the private vsock port to the given Unix socket, and on the host side Controller, ExecRequest and Process. The C header and ffier schema are regenerated. The vsock muxer now refuses guest TSI connections to a host-side listening Unix port, so the control socket cannot be reached from inside the guest with AF_UNIX hijacking.

Not covered: rlimits and capabilities for the exec'd process (follow-up), and KRUN_INIT_PID1=1, which is refused with a message for now.

Add init-control under tests/test_cases: it starts a second guest agent through the control socket, checks its environment, cwd, uid and exit code, then stops the workload with SIGTERM. Unit tests in krun-init-common run the real client against the real server.

Fixes https://github.com/libkrun/libkrun/issues/10 Related: https://github.com/libkrun/libkrun/issues/667, https://github.com/containers/crun/issues/2090

Validation

• cargo clippy --locked -- -D warnings for the default, amd-sev, tdx and net,blk,gpu,input feature sets, cargo fmt -- --check.
• make test TEST=init-control: passed (x86_64 Arch VM, nested KVM).
• End to end on bare-metal x86_64 (host kernel 7.2.8) with podman 6.1 and a crun built against this branch (AlphaJack/crun krun-exec): podman exec runs in the guest kernel, env/cwd/user are applied, exit codes propagate, health checks pass, podman stop returns in 0.2 s with exit 143, read-only root works.