fix(vm): create libkrunfw.dylib symlink on macOS after extraction

libkrun.dylib references libkrunfw via @loader_path/libkrunfw.dylib
(unversioned name set by build-libkrun-macos.sh), but the embedded
runtime only extracts libkrunfw.5.dylib (versioned). Create an
unversioned symlink so dyld can resolve the dependency.

Author: drew

crates/openshell-vm/src/embedded.rs

@@ -135,6 +135,18 @@ pub fn ensure_runtime_extracted() -> Result<PathBuf, VmError> {
     )?;
     extract_resource(resources::GVPROXY, &cache_dir.join("gvproxy"))?;
 
+    // On macOS, libkrun.dylib references libkrunfw via @loader_path/libkrunfw.dylib
+    // (the unversioned name), but we embed as libkrunfw.5.dylib. Create the
+    // unversioned name so dyld can resolve the dependency.
+    #[cfg(target_os = "macos")]
+    {
+        let unversioned = cache_dir.join("libkrunfw.dylib");
+        if !unversioned.exists() {
+            std::os::unix::fs::symlink(resources::LIBKRUNFW_NAME, &unversioned)
+                .map_err(|e| VmError::HostSetup(format!("symlink libkrunfw.dylib: {e}")))?;
+        }
+    }
+
     // Make gvproxy executable
     #[cfg(unix)]
     {