nvx-rs: group the host's modules into layered subsystems #899

Parent: #896. Needs: #897; preferably #898; and a decision whether the test-name changes below are acceptable.

Goal. Group host's children into private, layered subsystem modules, re-exported at today's paths:

python/, sandbox/ and cli/ stay where they are. host/mod.rs declares the groups as private modules and re-exports their children, for example pub use self::runtime::{artifacts, instance, launch, report, store, supervisor};, and the crate-private sys and spawn through private uses. Public paths and rustdoc URLs stay unchanged, because rustdoc inlines re-exports from private modules; verify this.

Today (dev 6af32ba0), with #897's moves, the groups are layered already: os ← policy, control ← runtime ← sandbox ← cli, and python is a leaf that runtime, sandbox and cli use.

Costs:

• The test names of moved modules change: host::store::tests::x becomes host::runtime::store::tests::x. Their source paths change too; git follows the renames.
• super:: paths across groups become crate::host:: paths. 14 imports in 7 files fail to compile until then: filesystem.rs:43, instance.rs:66, 67 and 69, launch.rs:13, 14 and 96, nvxs.rs:42, session.rs:10, store/mod.rs:239-242 and supervisor/mod.rs:108. 5 intra-doc links break, which cargo doc -D warnings reports: artifacts.rs:143, instance.rs:672, and process.rs:18, 19 and 38. A link retargets silently only where its new parent holds an item of the same name (nvx-rs: break the host module into finer-grained modules #896, invariant 6).
• No visibility changes: no item of a direct child of host is pub(super), so none names host. The 7 pub(super) items of seal.rs (seal.rs:261-358) sit in its inline imp modules, and name seal, which moves with them.
• #[cfg(unix)] and #[allow(unsafe_code)] move with the declaration of sys (host/mod.rs:65-67) into os.
• Links to moved files: nvx-rs/README.md:626 and 648 (src/host/store/mod.rs), and aci_edge_sandboxes/README.md:931 and 1164 (src/host/network/policy/mod.rs).
• Unaffected: the coverage family, because python stays; the bundling filter, because artifacts remains a substring of host::runtime::artifacts::tests::*; and the examples of the mutants workflow, because sandbox and cli stay (nvx-rs: break the host module into finer-grained modules #896, invariant 2).
• host::template, once the template stack lands (nvx-rs: break the host module into finer-grained modules #896), depends on sandbox, supervisor and instance, so it stays at the top level, beside sandbox and cli.

Guard. Extend #897's guard to check the group order: os ← policy, control ← runtime ← sandbox ← cli, with python a leaf.

Acceptance. Zero public API diff (#896, invariant 1). The guard enforces the group layering. The test list changes only by the documented prefix renames. CI is green.