feat(cli): run and probe commands

run maps the flags onto RunOptions, promotes the first read-write share
to the workspace, inherits stdio, and exits with the guest's code; probe
reports what a run would find (KVM, libkrun loadability with the
remediation, nested virt, cache writability) and fails when a run
would. T6, the no-mount audit, lives here where the binary is built,
ignored behind ECROU_BIN for CI.

crates/ecrou-cli/src/logger.rs

@@ -0,0 +1,47 @@
+//! stderr logging sink: `Warn`/`Error` records always, `Debug`
+//! diagnostics only with -v.
+
+use log::{Level, LevelFilter, Log, Metadata, Record};
+
+struct CliLogger {
+    max: LevelFilter,
+}
+
+impl Log for CliLogger {
+    fn enabled(&self, metadata: &Metadata) -> bool {
+        if metadata.level() > self.max {
+            return false;
+        }
+        match metadata.level() {
+            Level::Warn | Level::Error => true,
+            // Dependencies (hyper, rustls, …) share the log facade and are
+            // far noisier than we are; -v follows only our own diagnostics.
+            _ => metadata.target().starts_with("ecrou"),
+        }
+    }
+
+    fn log(&self, record: &Record) {
+        if !self.enabled(record.metadata()) {
+            return;
+        }
+        match record.level() {
+            Level::Error => eprintln!("Error: {}", record.args()),
+            Level::Warn => eprintln!("Warning: {}", record.args()),
+            _ => eprintln!("{}", record.args()),
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+/// Install the CLI logger: warnings and errors always, `ecrou` debug
+/// diagnostics only when `verbose` (-v).
+pub fn init(verbose: bool) {
+    let max = if verbose {
+        LevelFilter::Debug
+    } else {
+        LevelFilter::Warn
+    };
+    log::set_boxed_logger(Box::new(CliLogger { max })).ok();
+    log::set_max_level(max);
+}