Add the nvx-rs CLI - #596

A terminal's Ctrl-C reaches the whole foreground process group, so
nvx-rs sandbox run and the OpenVMM that it runs on the terminal
receive it together. run_openvmm polled OpenVMM before it checked
for the interrupt, so when OpenVMM had already exited from the same
Ctrl-C, the run returned OpenVMM's status instead of ending as
interrupted: on Unix, a SIGINT-ended OpenVMM made nvx-rs exit with
254 and print nothing, where nvx.py prints "Interrupted" and exits
with 130. Python's wait raises KeyboardInterrupt once SIGINT arrives,
whether or not the child has exited meanwhile.

run_openvmm now checks for the interrupt after each poll and before
it reports a status, and only waits for, then kills, an OpenVMM that
is still running. main() also lets a recorded Ctrl-C decide how any
command ends, as KeyboardInterrupt does wherever it finds a Python
command, so that a command that finished while Ctrl-C arrived still
prints "Interrupted" and exits with 130.

A new Linux test sends SIGINT to the CLI's whole process group, as a
terminal does, during a one-shot run whose fake OpenVMM the signal
ends at once. It failed with status 254 before this change, in three
of three runs, and passes now; the test that interrupts the CLI alone
still passes.

Reported in the review of #596.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx-rs sandbox identifies the OpenVMM of a running sandbox by its
process ID and start time, which identity.rs reads on Linux from
/proc/PID/stat. Ported from the former sandbox_lifecycle.py, it counted
every zombie as exited. But /proc reports a process as a zombie as soon
as its main thread exits, while its other threads may still run and
hold its descriptors, so exec and stop could reject a live VM as stale,
and deprovision could remove the state of a VM that still runs. The
library's platform::process_start_time, with which the process helpers
wait for and kill OpenVMM, already counts such a process as running
until its last thread exits, as Windows does, and so does the CLI's own
Windows branch; only its Linux branch disagreed.

linux_start_time now asks, for a zombie only, whether other threads
remain, through the platform's other_threads_remain, which reads
/proc/PID/task, and otherwise keeps its Python-compatible parsing and
messages. other_threads_remain becomes pub(crate) for that.

The stat-line test covers a zombie with and without other threads, and
an error while listing them. A new Linux test, like
process::tests::a_process_runs_until_its_last_thread_exits, makes the
main thread of a Python process exit through pthread_exit while another
thread sleeps: process_running holds until the process is killed. It
fails without the fix.

Copilot's review of #598 flagged this in code that #596 added, the
nvx-rs CLI; the platform helper is already on dev. The change stays
within the CLI's Linux identity check.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

A terminal's Ctrl-C reaches the whole foreground process group, so
nvx-rs sandbox run and the OpenVMM that it runs on the terminal
receive it together. run_openvmm polled OpenVMM before it checked
for the interrupt, so when OpenVMM had already exited from the same
Ctrl-C, the run returned OpenVMM's status instead of ending as
interrupted: on Unix, a SIGINT-ended OpenVMM made nvx-rs exit with
254 and print nothing, where nvx.py prints "Interrupted" and exits
with 130. Python's wait raises KeyboardInterrupt once SIGINT arrives,
whether or not the child has exited meanwhile.

run_openvmm now checks for the interrupt after each poll and before
it reports a status, and only waits for, then kills, an OpenVMM that
is still running. main() also lets a recorded Ctrl-C decide how any
command ends, as KeyboardInterrupt does wherever it finds a Python
command, so that a command that finished while Ctrl-C arrived still
prints "Interrupted" and exits with 130.

A new Linux test sends SIGINT to the CLI's whole process group, as a
terminal does, during a one-shot run whose fake OpenVMM the signal
ends at once. It failed with status 254 before this change, in three
of three runs, and passes now; the test that interrupts the CLI alone
still passes.

Reported in the review of #596.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

A terminal's Ctrl-C reaches the whole foreground process group, so
nvx-rs sandbox run and the OpenVMM that it runs on the terminal
receive it together. run_openvmm polled OpenVMM before it checked
for the interrupt, so when OpenVMM had already exited from the same
Ctrl-C, the run returned OpenVMM's status instead of ending as
interrupted: on Unix, a SIGINT-ended OpenVMM made nvx-rs exit with
254 and print nothing, where nvx.py prints "Interrupted" and exits
with 130. Python's wait raises KeyboardInterrupt once SIGINT arrives,
whether or not the child has exited meanwhile.

run_openvmm now checks for the interrupt after each poll and before
it reports a status, and only waits for, then kills, an OpenVMM that
is still running. main() also lets a recorded Ctrl-C decide how any
command ends, as KeyboardInterrupt does wherever it finds a Python
command, so that a command that finished while Ctrl-C arrived still
prints "Interrupted" and exits with 130.

A new Linux test sends SIGINT to the CLI's whole process group, as a
terminal does, during a one-shot run whose fake OpenVMM the signal
ends at once. It failed with status 254 before this change, in three
of three runs, and passes now; the test that interrupts the CLI alone
still passes.

Reported in the review of #596.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox will run nvx-rs sandbox with the options that its own
argparse front end read, and its type conversions, such as --layer,
--workload-user, and the integer options, move to nvx-rs. A value that
nvx-rs then refuses would read "usage: nvx-rs sandbox ..." and
"nvx-rs sandbox: error: ...", where nvx.py printed the usage and name
of its own parser.

A new global option, --prog PROG, names the program in usage, help,
and error messages, nvx-rs by default; nvx.py will pass its own name.
Each parser now describes its syntax as a Syntax value, its command
after the program's name, the usage parts of its options and
positionals, and the help after its usage, instead of static usage
and help text, and Exit::Usage and Exit::Help carry the text that the
syntax formats for the program. format_usage ports argparse's
HelpFormatter._format_usage for 80 columns: a usage that fits stays on
one line; otherwise a name of at most three quarters of the width is
followed by the options, and the positionals start a new line, while a
longer name takes a line of its own. For the default name, every usage
and help is byte for byte what the static text printed, which the
golden scenarios check, and for nvx.py, whose name has the length of
nvx-rs, the usage wraps as Python's does.

The top-level usage lists the new option, so the eight golden steps
whose unrecognized arguments the top-level parser reports, and the
generator's copy of that usage, change accordingly. The top-level help
describes --prog and wraps the help of --root as argparse wraps it; it
had one line of 79 columns.

Unit tests compare the wrapping of short and long names, and of
usages without options, with CPython 3.14's argparse, and a CLI test
checks the usage error of nvx.py sandbox for a root --workload-user,
recorded from CPython, a long name, the top-level parser, and help.
The README documents the option.

This changes the CLI of #596; it adds the option and keeps every
default output.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox now runs `nvx-rs --prog nvx.py --root REPO sandbox`
for every operation, with nvx.py's standard streams, and exits with
the status of nvx-rs, which ports command_sandbox, the lifecycle of
sandbox_lifecycle.py, and the control session of control_session.py
(#596). Python no longer checks, converts, or runs anything for the
command; the modules that nvx-rs replaced stay for the microVM tests
until a later commit moves those onto nvx-rs.

argparse stays the front end, so that the help, abbreviations, and
the usage errors that it reports (exit 2) work as before, and the help
is unchanged byte for byte at 80 and 120 columns. Every option keeps
its name, metavar, choices, and help, but none has a type converter or
a default: --layer, --workload-user, the integer options, --timeout,
and the paths are plain strings that nvx-rs converts and checks, and
nvx-rs applies the defaults, so Python duplicates neither. A
_SandboxOption action records each option as nvx-rs receives it:

- under its canonical name, so that `--dry` reaches nvx-rs as
  --dry-run, since nvx-rs does not expand abbreviations;
- in command-line order, so that each --mount-deny, --mount-allow,
  and --mount-write follows the --mount whose path it names, which
  nvx-rs attributes as nvx.py did; and
- with its value attached, --option=VALUE, so that a value that starts
  with "-" stays a value.

The operation, run by default, comes first. Only options that the
user gave are passed, so that the defaults live in nvx-rs alone.
--prog makes the usage errors that nvx-rs reports for the values that
it converts read "usage: nvx.py sandbox ..." and "nvx.py sandbox:
error: ...", as argparse printed them; the name has the length of
nvx-rs, so the usage wraps the same.

Usage errors keep their status and form, but which of two errors in
one command line is reported changes: argparse reports an invalid
choice or an unrecognized argument before nvx-rs sees a value that it
refuses, where it used to report whichever came first. Ctrl-C ends
the command with nvx-rs's Interrupted and status 130, once.

scripts/nvx_rs_fixtures.py recorded the golden fixtures of nvx-rs
from the Python implementation of nvx.py sandbox, the egress compiler,
and the Python semantics that the ports keep, and imported the
helpers that this commit removes from nvx.py. With nvx.py running
nvx-rs, the recordings are final, so the generator goes, and the
fixtures stay as frozen references that a deliberate change updates
by hand. Their metadata, .gitattributes, the README, the module
comments that named the generator, and doc/project-structure.md say
so.

The CLI tests of the Python implementation go, since the golden
scenarios of nvx-rs cover each of their cases, as do the systemd,
environment, network-option, and policy checks, and the tests of
`run` that also ran sandbox keep their `run` half. New tests check the
recorded arguments for abbreviations, attached values, order, and the
default operation, the call of nvx-rs and its status through main(),
the usage errors that argparse keeps, a missing nvx-rs, and, through a
fresh nvx.py with a stand-in for nvx-rs, shared standard streams and,
on POSIX hosts, one Interrupted and status 130 after Ctrl-C to the
process group. With NVX_RS set, the real nvx-rs runs a dry run of
options that need an attached value, an abbreviation, and a share
policy, a usage error with nvx.py's name, and a lifecycle error.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox will run nvx-rs sandbox with the options that its own
argparse front end read, and its type conversions, such as --layer,
--workload-user, and the integer options, move to nvx-rs. A value that
nvx-rs then refuses would read "usage: nvx-rs sandbox ..." and
"nvx-rs sandbox: error: ...", where nvx.py printed the usage and name
of its own parser.

A new global option, --prog PROG, names the program in usage, help,
and error messages, nvx-rs by default; nvx.py will pass its own name.
Each parser now describes its syntax as a Syntax value, its command
after the program's name, the usage parts of its options and
positionals, and the help after its usage, instead of static usage
and help text, and Exit::Usage and Exit::Help carry the text that the
syntax formats for the program. format_usage ports argparse's
HelpFormatter._format_usage for 80 columns: a usage that fits stays on
one line; otherwise a name of at most three quarters of the width is
followed by the options, and the positionals start a new line, while a
longer name takes a line of its own. For the default name, every usage
and help is byte for byte what the static text printed, which the
golden scenarios check, and for nvx.py, whose name has the length of
nvx-rs, the usage wraps as Python's does.

The top-level usage lists the new option, so the eight golden steps
whose unrecognized arguments the top-level parser reports, and the
generator's copy of that usage, change accordingly. The top-level help
describes --prog and wraps the help of --root as argparse wraps it; it
had one line of 79 columns.

Unit tests compare the wrapping of short and long names, and of
usages without options, with CPython 3.14's argparse, and a CLI test
checks the usage error of nvx.py sandbox for a root --workload-user,
recorded from CPython, a long name, the top-level parser, and help.
The README documents the option.

This changes the CLI of #596; it adds the option and keeps every
default output.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox now runs `nvx-rs --prog nvx.py --root REPO sandbox`
for every operation, with nvx.py's standard streams, and exits with
the status of nvx-rs, which ports command_sandbox, the lifecycle of
sandbox_lifecycle.py, and the control session of control_session.py
(#596). Python no longer checks, converts, or runs anything for the
command; the modules that nvx-rs replaced stay for the microVM tests
until a later commit moves those onto nvx-rs.

argparse stays the front end, so that the help, abbreviations, and
the usage errors that it reports (exit 2) work as before, and the help
is unchanged byte for byte at 80 and 120 columns. Every option keeps
its name, metavar, choices, and help, but none has a type converter or
a default: --layer, --workload-user, the integer options, --timeout,
and the paths are plain strings that nvx-rs converts and checks, and
nvx-rs applies the defaults, so Python duplicates neither. A
_SandboxOption action records each option as nvx-rs receives it:

- under its canonical name, so that `--dry` reaches nvx-rs as
  --dry-run, since nvx-rs does not expand abbreviations;
- in command-line order, so that each --mount-deny, --mount-allow,
  and --mount-write follows the --mount whose path it names, which
  nvx-rs attributes as nvx.py did; and
- with its value attached, --option=VALUE, so that a value that starts
  with "-" stays a value.

The operation, run by default, comes first. Only options that the
user gave are passed, so that the defaults live in nvx-rs alone.
--prog makes the usage errors that nvx-rs reports for the values that
it converts read "usage: nvx.py sandbox ..." and "nvx.py sandbox:
error: ...", as argparse printed them; the name has the length of
nvx-rs, so the usage wraps the same.

Usage errors keep their status and form, but which of two errors in
one command line is reported changes: argparse reports an invalid
choice or an unrecognized argument before nvx-rs sees a value that it
refuses, where it used to report whichever came first. Ctrl-C ends
the command with nvx-rs's Interrupted and status 130, once.

scripts/nvx_rs_fixtures.py recorded the golden fixtures of nvx-rs
from the Python implementation of nvx.py sandbox, the egress compiler,
and the Python semantics that the ports keep, and imported the
helpers that this commit removes from nvx.py. With nvx.py running
nvx-rs, the recordings are final, so the generator goes, and the
fixtures stay as frozen references that a deliberate change updates
by hand. Their metadata, .gitattributes, the README, the module
comments that named the generator, and doc/project-structure.md say
so.

The CLI tests of the Python implementation go, since the golden
scenarios of nvx-rs cover each of their cases, as do the systemd,
environment, network-option, and policy checks, and the tests of
`run` that also ran sandbox keep their `run` half. New tests check the
recorded arguments for abbreviations, attached values, order, and the
default operation, the call of nvx-rs and its status through main(),
the usage errors that argparse keeps, a missing nvx-rs, and, through a
fresh nvx.py with a stand-in for nvx-rs, shared standard streams and,
on POSIX hosts, one Interrupted and status 130 after Ctrl-C to the
process group. With NVX_RS set, the real nvx-rs runs a dry run of
options that need an attached value, an abbreviation, and a share
policy, a usage error with nvx.py's name, and a lifecycle error.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox will run nvx-rs sandbox with the options that its own
argparse front end read, and its type conversions, such as --layer,
--workload-user, and the integer options, move to nvx-rs. A value that
nvx-rs then refuses would read "usage: nvx-rs sandbox ..." and
"nvx-rs sandbox: error: ...", where nvx.py printed the usage and name
of its own parser.

A new global option, --prog PROG, names the program in usage, help,
and error messages, nvx-rs by default; nvx.py will pass its own name.
Each parser now describes its syntax as a Syntax value, its command
after the program's name, the usage parts of its options and
positionals, and the help after its usage, instead of static usage
and help text, and Exit::Usage and Exit::Help carry the text that the
syntax formats for the program. format_usage ports argparse's
HelpFormatter._format_usage for 80 columns: a usage that fits stays on
one line; otherwise a name of at most three quarters of the width is
followed by the options, and the positionals start a new line, while a
longer name takes a line of its own. For the default name, every usage
and help is byte for byte what the static text printed, which the
golden scenarios check, and for nvx.py, whose name has the length of
nvx-rs, the usage wraps as Python's does.

The top-level usage lists the new option, so the eight golden steps
whose unrecognized arguments the top-level parser reports, and the
generator's copy of that usage, change accordingly. The top-level help
describes --prog and wraps the help of --root as argparse wraps it; it
had one line of 79 columns.

Unit tests compare the wrapping of short and long names, and of
usages without options, with CPython 3.14's argparse, and a CLI test
checks the usage error of nvx.py sandbox for a root --workload-user,
recorded from CPython, a long name, the top-level parser, and help.
The README documents the option.

This changes the CLI of #596; it adds the option and keeps every
default output.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox now runs `nvx-rs --prog nvx.py --root REPO sandbox`
for every operation, with nvx.py's standard streams, and exits with
the status of nvx-rs, which ports command_sandbox, the lifecycle of
sandbox_lifecycle.py, and the control session of control_session.py
(#596). Python no longer checks, converts, or runs anything for the
command; the modules that nvx-rs replaced stay for the microVM tests
until a later commit moves those onto nvx-rs.

argparse stays the front end, so that the help, abbreviations, and
the usage errors that it reports (exit 2) work as before, and the help
is unchanged byte for byte at 80 and 120 columns. Every option keeps
its name, metavar, choices, and help, but none has a type converter or
a default: --layer, --workload-user, the integer options, --timeout,
and the paths are plain strings that nvx-rs converts and checks, and
nvx-rs applies the defaults, so Python duplicates neither. A
_SandboxOption action records each option as nvx-rs receives it:

- under its canonical name, so that `--dry` reaches nvx-rs as
  --dry-run, since nvx-rs does not expand abbreviations;
- in command-line order, so that each --mount-deny, --mount-allow,
  and --mount-write follows the --mount whose path it names, which
  nvx-rs attributes as nvx.py did; and
- with its value attached, --option=VALUE, so that a value that starts
  with "-" stays a value.

The operation, run by default, comes first. Only options that the
user gave are passed, so that the defaults live in nvx-rs alone.
--prog makes the usage errors that nvx-rs reports for the values that
it converts read "usage: nvx.py sandbox ..." and "nvx.py sandbox:
error: ...", as argparse printed them; the name has the length of
nvx-rs, so the usage wraps the same.

Usage errors keep their status and form, but which of two errors in
one command line is reported changes: argparse reports an invalid
choice or an unrecognized argument before nvx-rs sees a value that it
refuses, where it used to report whichever came first. Ctrl-C ends
the command with nvx-rs's Interrupted and status 130, once.

scripts/nvx_rs_fixtures.py recorded the golden fixtures of nvx-rs
from the Python implementation of nvx.py sandbox, the egress compiler,
and the Python semantics that the ports keep, and imported the
helpers that this commit removes from nvx.py. With nvx.py running
nvx-rs, the recordings are final, so the generator goes, and the
fixtures stay as frozen references that a deliberate change updates
by hand. Their metadata, .gitattributes, the README, the module
comments that named the generator, and doc/project-structure.md say
so.

The CLI tests of the Python implementation go, since the golden
scenarios of nvx-rs cover each of their cases, as do the systemd,
environment, network-option, and policy checks, and the tests of
`run` that also ran sandbox keep their `run` half. New tests check the
recorded arguments for abbreviations, attached values, order, and the
default operation, the call of nvx-rs and its status through main(),
the usage errors that argparse keeps, a missing nvx-rs, and, through a
fresh nvx.py with a stand-in for nvx-rs, shared standard streams and,
on POSIX hosts, one Interrupted and status 130 after Ctrl-C to the
process group. With NVX_RS set, the real nvx-rs runs a dry run of
options that need an attached value, an abbreviation, and a share
policy, a usage error with nvx.py's name, and a lifecycle error.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox now runs `nvx-rs --prog nvx.py --root REPO sandbox`
for every operation, with nvx.py's standard streams, and exits with
the status of nvx-rs, which ports command_sandbox, the lifecycle of
sandbox_lifecycle.py, and the control session of control_session.py
(#596). Python no longer checks, converts, or runs anything for the
command; the modules that nvx-rs replaced stay for the microVM tests
until a later commit moves those onto nvx-rs.

argparse stays the front end, so that the help, abbreviations, and
the usage errors that it reports (exit 2) work as before, and the help
is unchanged byte for byte at 80 and 120 columns. Every option keeps
its name, metavar, choices, and help, but none has a type converter or
a default: --layer, --workload-user, the integer options, --timeout,
and the paths are plain strings that nvx-rs converts and checks, and
nvx-rs applies the defaults, so Python duplicates neither. A
_SandboxOption action records each option as nvx-rs receives it:

- under its canonical name, so that `--dry` reaches nvx-rs as
  --dry-run, since nvx-rs does not expand abbreviations;
- in command-line order, so that each --mount-deny, --mount-allow,
  and --mount-write follows the --mount whose path it names, which
  nvx-rs attributes as nvx.py did; and
- with its value attached, --option=VALUE, so that a value that starts
  with "-" stays a value.

The operation, run by default, comes first. Only options that the
user gave are passed, so that the defaults live in nvx-rs alone.
--prog makes the usage errors that nvx-rs reports for the values that
it converts read "usage: nvx.py sandbox ..." and "nvx.py sandbox:
error: ...", as argparse printed them; the name has the length of
nvx-rs, so the usage wraps the same.

Usage errors keep their status and form, but which of two errors in
one command line is reported changes: argparse reports an invalid
choice or an unrecognized argument before nvx-rs sees a value that it
refuses, where it used to report whichever came first. Ctrl-C ends
the command with nvx-rs's Interrupted and status 130, once.

scripts/nvx_rs_fixtures.py recorded the golden fixtures of nvx-rs
from the Python implementation of nvx.py sandbox, the egress compiler,
and the Python semantics that the ports keep, and imported the
helpers that this commit removes from nvx.py. With nvx.py running
nvx-rs, the recordings are final, so the generator goes, and the
fixtures stay as frozen references that a deliberate change updates
by hand. Their metadata, .gitattributes, the README, the module
comments that named the generator, and doc/project-structure.md say
so.

The CLI tests of the Python implementation go, since the golden
scenarios of nvx-rs cover each of their cases, as do the systemd,
environment, network-option, and policy checks, and the tests of
`run` that also ran sandbox keep their `run` half. New tests check the
recorded arguments for abbreviations, attached values, order, and the
default operation, the call of nvx-rs and its status through main(),
the usage errors that argparse keeps, a missing nvx-rs, and, through a
fresh nvx.py with a stand-in for nvx-rs, shared standard streams and,
on POSIX hosts, one Interrupted and status 130 after Ctrl-C to the
process group. With NVX_RS set, the real nvx-rs runs a dry run of
options that need an attached value, an abbreviation, and a share
policy, a usage error with nvx.py's name, and a lifecycle error.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox will run nvx-rs sandbox with the options that its own
argparse front end read, and its type conversions, such as --layer,
--workload-user, and the integer options, move to nvx-rs. A value that
nvx-rs then refuses would read "usage: nvx-rs sandbox ..." and
"nvx-rs sandbox: error: ...", where nvx.py printed the usage and name
of its own parser.

A new global option, --prog PROG, names the program in usage, help,
and error messages, nvx-rs by default; nvx.py will pass its own name.
Each parser now describes its syntax as a Syntax value, its command
after the program's name, the usage parts of its options and
positionals, and the help after its usage, instead of static usage
and help text, and Exit::Usage and Exit::Help carry the text that the
syntax formats for the program. format_usage ports argparse's
HelpFormatter._format_usage for 80 columns: a usage that fits stays on
one line; otherwise a name of at most three quarters of the width is
followed by the options, and the positionals start a new line, while a
longer name takes a line of its own. For the default name, every usage
and help is byte for byte what the static text printed, which the
golden scenarios check, and for nvx.py, whose name has the length of
nvx-rs, the usage wraps as Python's does.

The top-level usage lists the new option, so the eight golden steps
whose unrecognized arguments the top-level parser reports, and the
generator's copy of that usage, change accordingly. The top-level help
describes --prog and wraps the help of --root as argparse wraps it; it
had one line of 79 columns.

Unit tests compare the wrapping of short and long names, and of
usages without options, with CPython 3.14's argparse, and a CLI test
checks the usage error of nvx.py sandbox for a root --workload-user,
recorded from CPython, a long name, the top-level parser, and help.
The README documents the option.

This changes the CLI of #596; it adds the option and keeps every
default output.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

nvx.py sandbox now runs `nvx-rs --prog nvx.py --root REPO sandbox`
for every operation, with nvx.py's standard streams, and exits with
the status of nvx-rs, which ports command_sandbox, the lifecycle of
sandbox_lifecycle.py, and the control session of control_session.py
(#596). Python no longer checks, converts, or runs anything for the
command; the modules that nvx-rs replaced stay for the microVM tests
until a later commit moves those onto nvx-rs.

argparse stays the front end, so that the help, abbreviations, and
the usage errors that it reports (exit 2) work as before, and the help
is unchanged byte for byte at 80 and 120 columns. Every option keeps
its name, metavar, choices, and help, but none has a type converter or
a default: --layer, --workload-user, the integer options, --timeout,
and the paths are plain strings that nvx-rs converts and checks, and
nvx-rs applies the defaults, so Python duplicates neither. A
_SandboxOption action records each option as nvx-rs receives it:

- under its canonical name, so that `--dry` reaches nvx-rs as
  --dry-run, since nvx-rs does not expand abbreviations;
- in command-line order, so that each --mount-deny, --mount-allow,
  and --mount-write follows the --mount whose path it names, which
  nvx-rs attributes as nvx.py did; and
- with its value attached, --option=VALUE, so that a value that starts
  with "-" stays a value.

The operation, run by default, comes first. Only options that the
user gave are passed, so that the defaults live in nvx-rs alone.
--prog makes the usage errors that nvx-rs reports for the values that
it converts read "usage: nvx.py sandbox ..." and "nvx.py sandbox:
error: ...", as argparse printed them; the name has the length of
nvx-rs, so the usage wraps the same.

Usage errors keep their status and form, but which of two errors in
one command line is reported changes: argparse reports an invalid
choice or an unrecognized argument before nvx-rs sees a value that it
refuses, where it used to report whichever came first. Ctrl-C ends
the command with nvx-rs's Interrupted and status 130, once.

scripts/nvx_rs_fixtures.py recorded the golden fixtures of nvx-rs
from the Python implementation of nvx.py sandbox, the egress compiler,
and the Python semantics that the ports keep, and imported the
helpers that this commit removes from nvx.py. With nvx.py running
nvx-rs, the recordings are final, so the generator goes, and the
fixtures stay as frozen references that a deliberate change updates
by hand. Their metadata, .gitattributes, the README, the module
comments that named the generator, and doc/project-structure.md say
so.

The CLI tests of the Python implementation go, since the golden
scenarios of nvx-rs cover each of their cases, as do the systemd,
environment, network-option, and policy checks, and the tests of
`run` that also ran sandbox keep their `run` half. New tests check the
recorded arguments for abbreviations, attached values, order, and the
default operation, the call of nvx-rs and its status through main(),
the usage errors that argparse keeps, a missing nvx-rs, and, through a
fresh nvx.py with a stand-in for nvx-rs, shared standard streams and,
on POSIX hosts, one Interrupted and status 130 after Ctrl-C to the
process group. With NVX_RS set, the real nvx-rs runs a dry run of
options that need an attached value, an abbreviation, and a share
policy, a usage error with nvx.py's name, and a lifecycle error.

Part of #359.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>