Sandbox: attach multiple virtio-fs shares with independent ro/rw modes #298

Part of #290 (requirement 2). Related: #281, which covers multiple filesystem mappings in general.

Summary

Matching AWF's Cloud Hypervisor mount policies needs at least two virtio-fs shares attached to one sandbox at the same time, each with its own guest mount point, device tag, and access mode:

1. Workspace (/workspace): read-write (rw).
2. Tool cache (/opt/hostedtoolcache or $RUNNER_TOOL_CACHE): read-only (ro). Write attempts must fail with EROFS/EACCES.
3. (Future) Temporary diagnostics directories, for example subdirectories of /tmp/gh-aw.

Each share's access mode must be enforced on the host/VMM side. Guest mount flags are not a security boundary against a compromised guest root.

Current state

#294 adds a single live share (--mount/--mount-deny) for sandbox run and sandbox provision. The microVM ABI has only one fixed virtio-fs slot (fs:microvm0, tag microvm, MMIO 0xd0001000, IRQ 6). The kernel bootstrap tokens (virtfs_dir, virtfs_tag, virtfs_mode) and the snapshot filesystem contract also describe only one share.

Work

• OpenVMM (nanvix/openvmm): add more fixed virtio-fs slots, each with its own stable ID, tag, MMIO address, and IRQ. Accept repeated --mount options, each with its own denied paths, and extend the command-line ABI and the snapshot/restore contract to cover several shares.
• NVX: promote the OpenVMM pin, accept a repeatable sandbox --mount, persist every share in the managed config, and mount each share in guest/common/nvx-init-agent (unmounting them in reverse order on teardown).
• Reject overlapping or nested guest targets, and tags that collide.

Acceptance criteria

• A sandbox can attach a rw /workspace share and a ro /opt/hostedtoolcache share at the same time.
• Writes to the ro share fail with EROFS/EACCES; writes to the rw share reach the host.
• Access modes are enforced by the VMM, not only by guest mount flags.
• CI covers concurrent ro and rw shares on KVM, MSHV, and WHP.