feat(linux): add VIRTUALIZATION workload support

[rezado]

Summary

Add VIRTUALIZATION=1, which packages a Linux workload as a nested KVM Guest
running inside a Linux Host, so virtual workloads are built and run through the
same outer NEMU / QEMU nemu flow as regular workloads. Simulator sources are
untouched.

Runtime flow

1. The outer simulator boots the Host firmware; Host init launches the inner
   qemu-system-riscv64 -machine virt,aia=none -bios none -accel kvm -cpu host ...
   and boots the Guest kernel + initramfs directly.
2. A generated Guest runner replaces the workload init: it emits non-terminal
   nemu-notify 256/257 (so nested traps are not mistaken for a terminal outer
   exit), runs the workload's normal init/inittab commands, and prints
   VIRT_WORKLOAD_EXIT=<status> as the single exit marker.
3. The Host parses that marker from the Guest serial stream, stops the inner
   QEMU, and execs /bin/nemu-trap <status>, so the outer simulator reports the
   real workload status (Hit GOOD TRAP; non-zero propagates as failure). A
   start timeout plus a strict single-marker check turn "Guest never started" or
   "multiple markers" into a failed run instead of a false pass.
4. A fixed seed is baked into the Host initramfs so boots are reproducible.

Supporting changes: the GCPT GCPT_PAYLOAD_FDT_ADDR patch hands mhartid/FDT
to the payload on checkpoint restore (Host FDT at 0x80200000);
INITRAMFS_OFFSET_ALIGNMENT_MB in scripts/build-firmware-linux.sh (virtual
Host uses 2 MiB); workload rules.mk route linux/<case> to the virtual
artifacts instead of DTB firmware when VIRTUALIZATION=1; linux/hello uses the
Linux exit syscall under virtualization.

Coverage

All Linux workloads: hello, CoreMark, CoreMark-PRO, RVV-Bench,
litmus-tests-riscv, kvmtool, SPEC CPU2006/2017/2026 cases, GAPBS, RocksDB,
SPECjbb2015, stress-ng, Geekbench 5/6.

Testing

• make spec2006-images PLATFORM=nemu VIRTUALIZATION=1 packages all default
  cases and exports matching bin/, dt/, manifest/ artifacts (12 cases).
• PLATFORM=nemu and PLATFORM=qemu dry runs parse without target conflicts;
  Python and shell syntax checks pass.
• Nested end-to-end run (outer simulator -> Host -> KVM Guest ->
  VIRT_WORKLOAD_EXIT=0 -> VIRT_HOST: workload exit 0 -> Hit GOOD TRAP):
  pending on this branch.

[poemonsense]

I think we should not let existing linux build rules depend on VIRTUALIZATION. Instead, we should create a standalone workloads/qemu directory that creates virtualization workloads with an input binary.

The user should build a target virt image by specifying an existing bin or elf file as input to qemu.

In that way, VIRTUALIZATION does not affect any existing workloads and is transparent to the underlying input files.

Basically, this qemu workload should also be configurable (e.g., mem_size).

[poemonsense]

should name this file to xiangshan_virt_host_defconfig

[poemonsense]

We should not change these existing workloads