feat(krun): run the library on macOS

The engine is libkrun.1.dylib, dlopen'd from the Homebrew kegs when
the loader's own search fails (bare sonames never reach the brew
prefix); the probe becomes a per-platform hypervisor probe — KVM on
Linux, sysctl + a real hv_vm_create on macOS, so an entitlement
denial (HV_DENIED) names the re-sign fix instead of surfacing as an
opaque krun_start_enter EINVAL. Tool lookup (mke2fs, debugfs) gains
the same keg fallback, and dyld_fallback_dirs() collects the kegs the
bare-soname dlopens (libkrunfw, libarchive) need in
DYLD_FALLBACK_LIBRARY_PATH. The machine child's parent-death contract
moves to a kqueue NOTE_EXIT watcher: macOS has no PR_SET_PDEATHSIG,
and SIGKILL-on-parent-exit is what keeps a killed caller from
stranding a booted machine.

crates/ecrou-cli/src/main.rs

@@ -116,8 +116,15 @@ fn cmd_probe() -> std::process::ExitCode {
 
     let mut ok = true;
 
-    print!("kvm:          ");
-    match krun::kvm_probe() {
+    print!(
+        "{}:      ",
+        if cfg!(target_os = "macos") {
+            "hypervisor"
+        } else {
+            "kvm"
+        }
+    );
+    match krun::hypervisor_probe() {
         Ok(()) => println!("ok"),
         Err(err) => {
             ok = false;
@@ -145,12 +152,20 @@ fn cmd_probe() -> std::process::ExitCode {
     print!("e2fsprogs:    ");
     let mut tools_ok = true;
     for tool in ["mkfs.ext4", "debugfs"] {
-        match std::process::Command::new(tool).arg("-V").output() {
-            Ok(_) => {}
-            Err(err) => {
+        match ecrou::utils::find_tool(tool) {
+            Some(path) => match std::process::Command::new(path).arg("-V").output() {
+                Ok(_) => {}
+                Err(err) => {
+                    ok = false;
+                    tools_ok = false;
+                    println!("{tool} not runnable ({err}); the rootfs image cannot be built");
+                    break;
+                }
+            },
+            None => {
                 ok = false;
                 tools_ok = false;
-                println!("missing {tool} ({err}); the rootfs image cannot be built");
+                println!("missing {tool}; install e2fsprogs, the rootfs image cannot be built");
                 break;
             }
         }