test(os): combine #1931 #1945 #1966 RC2 KVM gate

[VijitSingh97]

Summary

• carry the debug registry into the appliance environment so SSH-driven recovery uses the test registry
• wait for provisioning units before the restore leg captures its backup
• add the RC2 hostname, diagnostics, approval, backup/restore, and failed-install regression coverage
• re-arm the borrowed RigForge pool after control writes before worker-dependent phases
• fail closed on stale approvals, uncertain detached jobs, lost parent locks, mutable release inputs, unverifiable image provenance, surviving KVM guests, and libvirt query failures
• retry post-promotion reads until both user-facing tags resolve to the captured digest

This combines and supersedes #1939, #1947, and #1982 so their interacting appliance changes can be reviewed, run through CI, and exercised by one exact-image KVM lifecycle against the current develop head and RigForge v1.17.3.

Closes #1931.
Closes #1945.
Closes #1966.
Closes #1994.

Validation

• exact head: fd511612634a21ada55a349684c13a3a284f1aeb
• independent correctness and security reviews: PASS at the exact head
• focused release domain: 58 passed, 0 failed, including two valid stale registry reads before the expected digest appears
• parent-lock continuity: 31 passed, 0 failed
• borrowed-pool re-arm: 9 passed, 0 failed
• RigForge control barrier, approval, hostname, and diagnostics self-tests passed
• KVM teardown self-test covers surviving domain, libvirt query failure, and confirmed absence
• private cut syntax, format, ShellCheck, custody, artifact, and claim-retention controls passed
• file-budget, generated CLI, and test-inventory gates passed
• fresh exact-head CI: pending
• combined backup/restore KVM lifecycle: pending

The three remaining local selftest-e2e-phases failures are the known BSD wc whitespace difference; the changed phase, token, launch-intent, PID, and drain assertions pass locally and are exercised by Linux CI.

Companion release

Requires p2pool-starter-stack/rigforge#492 (test: fail closed across combined appliance gates). The two must be tested together: this branch carries the immutable RigForge build override through the appliance lifecycle and forwards the rollback input to the detached matrix runner, and #492 is the v1.17.4 companion those gates run against. Neither should merge without the combined acceptance matrix covering both.

CI status

Both red checks at head d3a8a96c are inherited from develop, not introduced here:

• Build + scan the appliance rootfs — trivy flags CVE-2026-84445 (HIGH) in google.golang.org/grpc v1.83.1, vendored into the cosign and docker-compose binaries. develop pins that raise in os/rootfs/Dockerfile; this branch does not touch the pin. The bump to v1.83.2 is already committed on Refactor repository into feature folders and finish oversized module splits #2005 and clears it there.
• Secret scan (gitleaks) — all 8 findings sit in commit 2a231511, which belongs to Refactor repository into feature folders and finish oversized module splits #2005's branch and is not an ancestor of this head. gitleaks scans every pushed ref, so an unrelated in-flight branch reddens this job on every open PR.

Both clear once #2005 lands on develop; nothing to change here.

[VijitSingh97]

Independent exact-head review: PASS at fd511612634a21ada55a349684c13a3a284f1aeb against develop a03d0796b8e28d1beca87b5a118a4f681997fb66.

The correctness and security reviews found and rechecked the fail-closed VM teardown, libvirt query errors, nested restore-artifact retention, approval-fixture cleanup, root-owned release staging, detached parent-lock continuity, RigForge re-arm ordering, immutable Compose provenance, and post-promotion digest visibility retry. No critical, high, or medium actionable defect remains in the PR delta.

Bounded local evidence: release domain 58/0; parent-lock 31/0; borrowed-pool re-arm 9/0; focused appliance and procedure controls passed. Fresh CI and the exact-image KVM battery remain separate execution gates before merge.