Add embedded Linux sandbox runtime and versioned guest init

[Vbitz]

Summary

• Expose a narrow in-process Linux/amd64 sandbox runtime with direct virtio filesystem backends and independent guest networking.
• Extract reusable guest init and add the versioned SA2 protocol, explicit process modes, binary file helpers, and guest-local TCP proxy.
• Preserve digest selectors and verify OCI manifest bodies; correct FUSE errno and directory fallback handling.
• Package generated init payloads through tracked placeholder directories and explicit build helpers.

Audit and validation

• Reviewed Server/Peer integration in dependent SA2 work; corrected escaped-descendant completion and concurrent payload generation issues.
• Guestinit and targeted runtime/virtio/protocol tests pass, including race tests.
• go vet ./... passes.
• Dependent SA2 full tests and real KVM Peer + peerless Go/SCS/submodule workflows pass.
• go test -short ./... still encounters the pre-existing unchanged estargz repacking panic: footer buffer = 48, not 51. The repacker/test/dependency version predate this patch; not claiming that broad suite green.

Please merge through the repository merge queue. No bypass requested.