feat(vm): the machine runs as a child; the console streams through a file

The exit-code contract needed a rethink once the real libkrun was in
the loop: on a normal payload exit the VMM ends its own process with
the payload's code, so run() forks and the child enters the VM loop.
The parent reaps it and the code flows to the consumer; the control
file stays as the boot-failure diagnostic, and the guest script no
longer powers off - the init blob does that when the script exits,
since the libkrunfw kernel has no sysrq.

The console cannot ride stdio: with a tty on fd 0 libkrun stops a
background caller with SIGTTOU, and without one it routes guest bytes
through its logger. So the console goes to a file in the scratch that
the parent streams to real stdout, with a final drain after the reap;
the child unwires fd 0 to /dev/null so the terminal is never touched
and a Ctrl-C to the process group still reaches the guest. PDEATHSIG
keeps T4: a killed consumer is a killed machine. The hostname and
workdir now ride the set_exec config natively (the init blob applies
them); log level follows quiet/verbose.

Also in the CLI: the command after '--' was parsed but never copied
into RunOptions, so every run executed the image's default shell.

crates/ecrou-cli/src/main.rs

@@ -17,17 +17,19 @@ fn main() -> std::process::ExitCode {
     let cli = Cli::parse();
     logger::init(cli.verbose);
     match cli.command {
-        Command::Run(args) => cmd_run(&args),
+        Command::Run(args) => cmd_run(&args, cli.verbose),
         Command::Probe => cmd_probe(),
     }
 }
 
-fn cmd_run(args: &RunArgs) -> std::process::ExitCode {
+fn cmd_run(args: &RunArgs, cli_verbose: bool) -> std::process::ExitCode {
     let mut options = RunOptions {
         image: args.image.clone(),
+        command: args.command.clone(),
         memory: args.memory.clone(),
         workdir: args.workdir.clone(),
         quiet: args.quiet,
+        verbose: cli_verbose,
         no_cache: args.no_cache,
         ..RunOptions::default()
     };