Add OCI image support

.ci/check-matrix-lists.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+
+# Keep the test-matrix skip lists honest.
+#
+# tests/test-matrix.sh runs each test under two runners and carries a skip list
+# per runner: QEMU_SKIP for tests the reference kernel cannot adjudicate,
+# ELFUSE_SKIP for tests that need a writable byte-exact root the elfuse lane
+# does not have. Both lists are matched against a test's label by string, and a
+# string that matches nothing fails silently: the suite still reports success,
+# having run one test fewer than the reader believes.
+#
+# Two ways that goes wrong, both of which cost coverage without costing a red
+# build, and neither of which the suite itself can notice:
+#
+#   1. A label in a skip list that no longer names a registered test. Dead
+#      config: it reads as deliberate coverage policy while guarding nothing,
+#      and it hides the rename that orphaned it.
+#   2. A label in both lists at once. The test is then skipped under every
+#      runner the matrix has, so it never executes anywhere while still looking
+#      registered.
+#
+# The pass counts themselves are not checked here. test-matrix.sh already holds
+# each lane to its EXPECTED_BASELINES floor at runtime, which is a stronger
+# check than anything static, and duplicating it would only add a second number
+# to keep in step.
+
+set -e -u -o pipefail
+
+MATRIX="${1:-$(dirname "$0")/../tests/test-matrix.sh}"
+
+if [ ! -r "$MATRIX" ]; then
+    echo "check-matrix-lists: cannot read $MATRIX" >&2
+    exit 2
+fi
+
+# Body of a NAME="..." block spanning lines, one entry per line.
+list_entries()
+{
+    sed -n "/^$1=\"/,/^\"\$/p" "$MATRIX" | sed '1d;$d' | tr -s ' \t' '\n' \
+        | grep -v '^$' || true
+}
+
+# Labels registered with the test_* wrappers: the argument after "$runner".
+registered_labels()
+{
+    grep -oE '\btest_(check|rc|pipe) +"\$runner" +"[^"]+"' "$MATRIX" \
+        | sed -E 's/.*"\$runner" +"([^"]+)"$/\1/' | sort -u
+}
+
+ret=0
+registered="$(registered_labels)"
+
+for list in QEMU_SKIP ELFUSE_SKIP; do
+    while IFS= read -r label; do
+        [ -n "$label" ] || continue
+        if ! printf '%s\n' "$registered" | grep -qxF "$label"; then
+            echo "Error: $list names '$label', which no test_* call registers" >&2
+            ret=1
+        fi
+    done < <(list_entries "$list")
+done
+
+while IFS= read -r label; do
+    [ -n "$label" ] || continue
+    if list_entries QEMU_SKIP | grep -qxF "$label"; then
+        echo "Error: '$label' is in both QEMU_SKIP and ELFUSE_SKIP, so it never runs" >&2
+        ret=1
+    fi
+done < <(list_entries ELFUSE_SKIP)
+
+exit $ret

.github/actions/hvf-elfuse-setup/action.yml

@@ -0,0 +1,66 @@
+name: HVF elfuse setup
+description: >
+  Shared setup for the self-hosted HVF workload jobs: fail fast if the run is
+  superseded by a newer PR commit, then fetch the prebuilt elfuse binary from
+  the build-macos job and build the pure-Go elfuse-oci CLI. Assumes the repo is
+  already checked out.
+
+runs:
+  using: composite
+  steps:
+    # Fail fast if this run targets a commit that is no longer the PR's HEAD.
+    # cancel-in-progress covers a newer push, but not a manual "Re-run jobs" on
+    # an old run, which would burn the self-hosted runner re-testing stale code.
+    # Mirrors the runtime-macos guard; fails (not cancels) because repo policy
+    # caps the token at actions: read. The lookup fails open.
+    - name: Fail fast if superseded by a newer PR commit
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        RUN_SHA: ${{ github.event.pull_request.head.sha }}
+      run: |
+        set -uo pipefail
+        latest=$(curl -fsSL \
+          -H "Authorization: Bearer $GH_TOKEN" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/$REPO/pulls/$PR_NUMBER" \
+          | python3 -c 'import json,sys; print(json.load(sys.stdin)["head"]["sha"])') \
+          || latest=""
+        echo "Run targets : $RUN_SHA"
+        echo "PR HEAD now : ${latest:-<unknown>}"
+        if [ -n "$latest" ] && [ "$latest" != "$RUN_SHA" ]; then
+          echo "::error::This run targets $RUN_SHA, but PR #$PR_NUMBER HEAD is now $latest -- the commit is no longer the latest. Failing instead of re-testing stale code on the self-hosted runner; re-run CI on the current commit."
+          exit 1
+        fi
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        cache: true
+
+    # Reuse the arm64 elfuse binary built + entitlement-checked by build-macos
+    # instead of rebuilding the C project on the self-hosted runner five times.
+    # Mach-O code signatures (and their embedded HVF entitlement) travel inside
+    # the binary, so they survive the artifact zip round-trip; only the execute
+    # bit is lost and restored here.
+    - name: Download prebuilt elfuse binary
+      uses: actions/download-artifact@v7
+      with:
+        name: elfuse-${{ runner.os }}-${{ runner.arch }}
+        path: build
+
+    - name: Restore execute bit + verify HVF entitlement
+      shell: bash
+      run: |
+        set -euo pipefail
+        chmod +x build/elfuse
+        codesign -d --entitlements - build/elfuse 2>&1 \
+          | grep -q 'com\.apple\.security\.hypervisor'
+
+    - name: Build elfuse-oci
+      shell: bash
+      run: make build/elfuse-oci