Add first-party SimpleVM Guest Tools

[serhatandic]

Summary

• add a compatible v2 Guest Agent protocol, hardened Apple vsock and QEMU virtio-serial transports, explicit lifecycle/error handling, and capability-gated runtime integration
• ship an auditable split-privilege Linux agent for systemd Debian/Ubuntu and Arch/Omarchy with fixed power, share-mount, clipboard, and Hyprland resize operations
• add truthful bundle export/shared-folder delivery UX, Machine Detail status/capabilities/retry actions, tests, and security/install documentation

Validation

• make test — 28 core tests and strict app build pass
• make app-test — 46 hosted tests pass, 2 hardware fixtures skipped
• GuestTools/self-test.sh — 19 guest tests pass
• focused Guest Tools UI delivery test passes
• Claude Opus 5 high-effort review completed with all findings fixed and final clean sign-off

Install UX

SimpleVM can export simplevm-guest-tools.tar.gz for any backend. Apple VZ machines with a configured virtiofs share can copy it there in one action; the app then shows the exact guest-side extraction/install command. Delivery never supplies a password, modifies a guest disk, or claims installation succeeded.

Capabilities and caveats

• status, distro/desktop/session detection, graceful shutdown/reboot, fixed share virtiofs mount, bounded UTF-8 clipboard, and validated Hyprland display resize are capability-gated
• QEMU currently exports the bundle but does not expose a host-directory virtiofs share
• Apple VZ GNOME/X11 clipboard is not currently available; QEMU GNOME/X11 uses SPICE and spice-vdagent
• Hyprland/Wayland clipboard requires wl-clipboard; vanilla spice-vdagent is not represented as solving Hyprland clipboard or resize
• VMs continue to boot and run normally when Guest Tools are absent or fail