Extract shared execution policy and enclave lifecycle from Cloud Hypervisor #10336

Goal

Extract reusable policy and lifecycle machinery from Cloud Hypervisor while preserving its existing behavior and backend-specific confinement guarantees. Part of #10335, step 2.

Scope

• Introduce backend-neutral role policies and identities, trusted run-state derivation, invocation planning, input staging, result validation, and settlement.
• Share authenticated host-service startup/readiness, admission closure, cancellation, draining, resource-journal coordination, recovery ordering, and protected diagnostics.
• Reuse the existing broker-to-host protocol and HostEnclaveExecutorBackend seam; generalize Cloud Hypervisor-only broker routing without accepting launch controls from invocation requests.
• Define shared bounded-storage requirements and verification interfaces; keep allocation and mount enforcement backend-specific where necessary.
• Keep artifact formats/provenance, launch/confinement, mount realization, networking, resource identity verification, and resource reaping in backend adapters.
• Retain appropriate primary-runtime integration seams rather than forcing Docker Compose and NVX atomic execution into Cloud Hypervisor's persistent-manager model.
• Preserve Cloud Hypervisor-specific artifact discovery and acceptance gates behind its adapter.

Starting points

• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/enclave/host-executor-server.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/enclave/host-executor-protocol.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/enclave/cloud-hypervisor-lifecycle.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/src/cloud-hypervisor/host-enclave-executor.ts
• /home/runner/work/gh-aw-firewall/gh-aw-firewall/containers/enclave/mcp-server/host-executor-runner.js

Acceptance criteria

• Cloud Hypervisor operates through the extracted interfaces with unchanged public behavior and preserved protocol/settlement semantics.
• Existing characterization and Cloud Hypervisor tests pass; real-backend acceptance remains gated appropriately.
• Shared policy/lifecycle code does not depend on Cloud Hypervisor manager types or artifact formats.
• Backend contracts accommodate NVX one-shot execution and Docker lifecycle requirements without fake persistent readiness.
• Tests cover startup failure, readiness, cancellation/shutdown races, incomplete cleanup, and recovery-state retention.
• No caller-controlled runtime, path, mount, environment, credential, or resource authority is added.

Dependencies

Requires the reviewed contract and characterization in step 1 of #10335.