fix(host): guard unqualified native VM operations

[NovusEdge]

What changed

Make the CLI build on macOS ARM64 and Windows AMD64, while refusing unqualified native VM operations before data-root setup, key or parameter resolution, stale runtime-file cleanup, or process startup. Help, version, and doctor remain available.

Separate Linux process identity and host checks from native refusal behavior, add a Windows xattr boundary, and keep metadata readers available. Native CI builds the CLI and executes lock, host-check, and refusal tests.

Why

Successful compilation must not expose the Linux QEMU/KVM runtime on an unqualified host. This prerequisite allows native development and diagnostics while keeping the runtime boundary explicit.

Depends on #79. The companion capability-discovery PR #78 has an independent early read-only dispatch; combined integration must preserve it before the guard.

Tests run

• just check and full just test at the production head
• Exact CI lint and ShellCheck path through Nix: 0 issues
• Focused native-refusal, capability-discovery, and hostcheck fixture tests at 61161f3
• Darwin ARM64 and Windows AMD64 package test compilation at 61161f3
• Independent Sol-high terminal review, including final selector and fixture-only corrections at 61161f3: ready with no remaining findings
• Hosted macOS/Windows CI on 61161f3
• Fresh Linux AMD64 lifecycle regression gate: Run the native-guard Linux lifecycle regression gate #87

Darwin ARM64, Windows AMD64, and Linux ARM64 CLI/installer cross-builds pass. The first hosted macOS run exposed an over-broad selector that also matched three Linux runtime tests; 90cb217 anchors the expression to the intended native diagnostics, refusal, and capability cases. The next Windows run exposed a hostcheck fixture that omitted .exe; 61161f3 uses the platform-correct fake executable name without changing production lookup. Cross-builds do not qualify VM runtime support.

OS matrix

No guest additions. Linux AMD64 lifecycle regression evidence is tracked in #87.

Docs

• Unsupported native installer diagnostics explain the Linux requirement.

No native release archive, HVF/WHPX backend, ARM guest, firmware, or sharing support is introduced. Existing Linux ARM64 release assets are unchanged; that target remains build evidence with the existing x86-only runtime limitation. This remains a draft until hosted CI and #87 finish. Final human review and merge remain with the maintainer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}