refactor(vm): the engine owns a LogLevel, not UI booleans

RunOptions carried quiet/verbose, which are flags, not engine state.
They are now a LogLevel enum (Quiet/Normal/Verbose) mapped onto
libkrun's filter; the CLI maps its flags onto it. The forked child's
last-gasp boot diagnostics also stop going straight to stderr: they
land in the console file the parent streams, with stderr kept for the
case where the console was never configured. lib.rs now states the
crate contract: no UI in the library, progress through the sink,
logging through the facade, typed errors out.

crates/ecrou-cli/src/main.rs

@@ -8,7 +8,7 @@ mod progress;
 
 use clap::Parser;
 use ecrou::vm::RunOptions;
-use ecrou::{NoProgress, Progress};
+use ecrou::{LogLevel, NoProgress, Progress};
 
 use cli::{parse_env, parse_share, Cli, Command, RunArgs};
 use progress::TermProgress;
@@ -28,8 +28,13 @@ fn cmd_run(args: &RunArgs, cli_verbose: bool) -> std::process::ExitCode {
         command: args.command.clone(),
         memory: args.memory.clone(),
         workdir: args.workdir.clone(),
-        quiet: args.quiet,
-        verbose: cli_verbose,
+        log_level: if args.quiet {
+            LogLevel::Quiet
+        } else if cli_verbose {
+            LogLevel::Verbose
+        } else {
+            LogLevel::Normal
+        },
         no_cache: args.no_cache,
         ..RunOptions::default()
     };