nvx-rs: give each guest build an identity from its build inputs, and package it #820

Parent: #816. Independent of the other children; #821 reports the identity in Ready.

Goal. Each guest build carries a versioned build ID, derived from its canonical build inputs, so that a host can check at Ready that it runs the guest that its bundle names, without hashing binaries at runtime.

Today (dev c5a0dd7):

• No guest build identity exists. Artifact discovery finds the guest's files by name.
• A bundle's provenance is its release tag and its SHA-256 sums, which bundled checks at build time against nvx-rs/artifacts.json.

Scope:

1. Build ID: a versioned ID derived at build time from canonical build inputs (sources, lockfiles, recipes and package pins, toolchain, target, profile and features), and embedded before linking. The running binary is never hashed.
2. Binding: generated metadata binds the initramfs to that ID, and artifact discovery returns the expected ID with the artifacts.
3. Packaging: contract metadata, guest identity and provenance, bundle validation and release packaging change together, in CI and in the release scripts.
4. The runtime identity for reattach stays A1-host's.

Not in scope: Ready's format and validation (#821); the bundled re-pin (#624).

Acceptance:

• Builds from the same inputs get the same ID, and a change in each class of input changes it.
• The initramfs metadata, artifact discovery and release packages report the ID.
• No runtime path hashes a binary.

Carries over: #623's scope 8 and the build ID of its scope 5 (A5 PR 4).