nvx-rs: split the host's oversized files into directory modules #898

Parent: #896. Needs: #897: the artifacts split includes the helpers that #897 moves there, and its guard protects the layering.

Goal. Split host's oversized files into directory modules along their existing sections, with no public API change and no test-name change. Inline mod tests blocks move to X/tests.rs and keep their module path.

Today (dev 6af32ba0), the candidates, in production lines without their inline tests:

sandbox/plan.rs (853 lines) stays whole: its form already lives in plan/form.rs, and #884 and #888 extend it.

Splits. Today's line ranges, in nvx-rs/src/host/:

filesystem.rs → filesystem/:

• mod.rs: the constants and types (filesystem.rs:48-221 and 284-375), plan and the checks of its mappings (377-755), the root checks that plan and ExportPlan::check share (1241-1316), and Mapped (1935-1949).
• guest_path.rs: guest_source, guest_path and resolve_guest_path (222-282), and within and depth (1951-1964).
• policy.rs: the resolution of access policies, from PolicyPath through writable_part (757-1239).
• verify.rs: ExportPlan::{check, verify, kernel_token, guest_table, openvmm_arguments}, their helpers, and the accessors of ExportChild (1318-1783).
• limits.rs: check_root, check_policy_paths and policy_limits (1785-1901).
• host_path.rs: is_reparse_point, identity and relative_text (1903-1933), and canonicalize, canonicalize_lenient, strip_verbatim and display_path (1966-2040).
• tests.rs: 2042-3726.

platform/windows.rs → platform/windows/, and platform/linux.rs → platform/linux/:

platform/mod.rs keeps its surface, pub(crate) use imp::* and pub use imp::{SUPPORTED, create_private_dir, file_identity, process_start_time} (platform/mod.rs:27-35), so each mod.rs re-exports its submodules' items. #[allow(unsafe_code)] stays on mod windows (platform/mod.rs:22-25), and covers its submodules.

artifacts.rs → artifacts/:

• mod.rs: Artifacts and its discovery (artifacts.rs:45-361), and the constants of the layouts and their metadata (363-390).
• guest.rs: Guest (392-490).
• dir.rs: Layout and ArtifactDir (492-769), and ArtifactPaths and GuestPaths (878-918).
• identity.rs: sha256_identity, read_metadata and provenance_identity (771-869).
• require.rs: required (871-876), and the helpers that nvx-rs: make the host module's dependency graph acyclic #897 moves to artifacts.
• tests.rs: 920-1646. The module keeps its name, so that the bundling step's artifacts filter still selects these tests.

instance.rs → instance/:

• mod.rs: generate_capability and the helpers of launches and sessions (instance.rs:207-279), Found and its states (281-399), and Instance (401-606).
• files.rs: the private-file helpers (84-205), with the public write_private, write_json, read_json, remove_if_present and remove_interrupted_writes.
• locked.rs: LockedInstance and check_timeout (608-869).
• execution.rs: OutputSink, WorkloadOutcome and Execution (871-1035).
• tests.rs: 1037-1248.

network/mod.rs, into new files beside it:

• rule.rs: Access (network/mod.rs:55-72), Protocol through EgressRules (111-331), and parse_rules and parse_rule (785-836).
• loopback.rs: HostLoopback (74-109), ForwardProtocol and LoopbackForward (333-391), and check_loopback_forwards (838-916).
• proxy.rs: ProxyScheme and NetworkProxy (393-525).
• arguments.rs: openvmm_arguments, proxy_arguments and check_proxy_only (613-783), and guest_subnet (918-927).
• tests.rs: 929-1916.
• NetworkPolicy (527-611) and the constants (40-53) stay in mod.rs. The existing network::policy submodule holds the egress policy files, not NetworkPolicy.

sandbox/mount.rs → sandbox/mount/, which holds its tests.rs already:

• mod.rs: the constants, and the access, owner, kind and policy types (mount.rs:42-252).
• request.rs: the parsing and checks of mount values and targets (254-369), and SandboxMount (371-725).
• host_paths.rs: HostQueries through check_distinct_host_paths (727-870).
• aggregate.rs: aggregate_child_name through plan_mounts_with (872-999).
• boot.rs: BootShares, boot_shares and the command-line fragments (1001-1187).

store/mod.rs, whose first 211 lines are the module's documentation:

• names.rs: FORMAT and the file names (store/mod.rs:246-281).
• locked.rs: LockedStore (589-866).
• launch.rs: end_process, Recovery and Launch (868-987).
• SandboxStore and its helpers stay in mod.rs.

supervisor/mod.rs:

• launch.rs: launch, abandon_after and Starting (supervisor/mod.rs:116-323).
• vmm.rs: Vmm, StopOutcome, Stopped, and the stop and terminate steps (325-598).
• reattach.rs: Reattached, reattach and reattach_with (600-703).

cli/sandbox/lifecycle.rs → cli/sandbox/lifecycle/:

• mod.rs: the configuration, provision, find_vm and the lookups of running VMs (lifecycle.rs:85-101 and 342-500).
• directory.rs: the state directory (103-204).
• outcome.rs: the outcome files (206-340).
• start.rs: start through exec_workload (502-834).
• stop.rs: stop through deprovision (836-995).
• tests.rs: 997-1114.

cli/sandbox/mod.rs:

• options.rs: the parser, SYNTAX through sandbox_network (cli/sandbox/mod.rs:59-523).
• one_shot.rs: run_openvmm, OneShot, end_interrupted and spawn_error (811-938).

Rules:

• One file per PR, or per commit.
• Rename a file that becomes X/mod.rs with git mv, in a commit of its own, before splitting it, so that git log --follow and blame follow it.
• Private helpers shared across the new siblings become pub(super). Public items are re-exported from mod.rs.
• Moved intra-doc links that use super:: get crate:: paths (nvx-rs: break the host module into finer-grained modules #896, invariant 6). A submodule named after an item of its parent (filesystem::guest_path, supervisor::launch, and the CLI's start and stop) makes the links to that item ambiguous (filesystem.rs:19 and 287, supervisor/mod.rs:13, cli/sandbox/lifecycle.rs:26-50), so they take fn@.
• Duplicated helpers are not merged (nvx-rs: break the host module into finer-grained modules #896).
• A file that open PRs edit waits until they land. network/mod.rs, artifacts.rs, cli/sandbox/mod.rs and sandbox/mount.rs can go first.

Acceptance, per split: zero public API diff (#896, invariant 1), an identical cargo test -- --list on Linux and Windows, the guard green, and CI green.