Feat/oci runtime groundwork

[Unique-Usman]

TL;DR

Add reusable guest-process, state, stdin, and startup-diagnostic support
needed by an OCI runtime, without introducing the runmsb CLI itself.

Description

• Add OCI bundle parsing, typed lifecycle validation, extension state,
  contextual errors, and an atomic filesystem state store under
  crates/runtime/lib/oci.
• Harden state creation and updates against concurrent creates, delete/save
  races, shared temporary filenames, and interrupted writes.
• Extend agentd process execution for OCI workloads, including defensive
  /dev/ptmx setup, standard devpts permissions, bare-command lookup
  through PATH, numeric users, and conventional 128 + signal exit
  statuses.
• Keep pre_exec failures allocation-free by converting setup failures to
  plain errno-based I/O errors.
• Capture detached sandbox startup stderr and include a bounded tail in
  startup failures while releasing metrics reservations on every error path.
• Centralize initial stdin handling for local and cloud execution so null
  stdin sends EOF, byte input sends data followed by EOF, and piped stdin
  remains open.
• Add an end-to-end regression test proving that cat exits when launched
  with null stdin.
• Document the user-visible stdin and signal-exit behavior changes in the
  changelog.

Test Plan

cargo +nightly fmt --all -- --check
cargo +nightly clippy -j 2 \
  -p microsandbox-runtime \
  -p microsandbox-agentd \
  -p microsandbox \
  -- -D warnings
cargo +nightly test -j 2 -p microsandbox-runtime --lib oci
cargo +nightly test -j 2 -p microsandbox-agentd --lib
cargo +nightly test -j 2 -p microsandbox --lib initial_stdin_messages
cargo +nightly test -j 2 -p microsandbox --test stdin stdin_null_lets_cat_finish

The final stdin integration test requires a host capable of starting
Microsandbox VMs.

Sequence Diagram

sequenceDiagram
  participant SDK
  participant AgentClient
  participant Agentd
  participant Process
  SDK->>AgentClient: ExecRequest
  AgentClient->>Agentd: Start session
  Agentd->>Process: Spawn with pipe or PTY
  SDK->>AgentClient: Initial ExecStdin messages
  AgentClient->>Agentd: Data and/or empty EOF message
  alt Pipe stdin
    Agentd->>Process: Write data or drop ChildStdin
  else PTY stdin
    Agentd->>Process: Write through PTY master
    Note over Agentd,Process: Empty message cannot close PTY input
  end
  Process-->>Agentd: Output and exit
  Agentd-->>SDK: Exec events

Loading

Prompt To Fix All With AI

### Issue 1
sdk/rust/lib/sandbox/exec.rs:513
**Null stdin stays open on PTYs**

When an execution combines the default `StdinMode::Null` with `tty(true)`, this empty message reaches `close_stdin`, which only drops pipe stdin and leaves the PTY master open. A command that reads from stdin, such as `cat`, therefore waits indefinitely instead of receiving EOF.

### Issue 2
crates/runtime/lib/oci/store.rs:103-112
**State directory reuse is unsynchronized**

If save, delete, and recreation of the same container ID overlap, `save` can validate the old directory and then create or rename its temporary file through a newly recreated path. This can overwrite the new container's `state.json` with stale lifecycle data, while the corresponding delete race can remove newly created state.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(exec): send EOF for non-interactive ..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

[greptile-apps]

Null stdin stays open on PTYs

When an execution combines the default StdinMode::Null with tty(true), this empty message reaches close_stdin, which only drops pipe stdin and leaves the PTY master open. A command that reads from stdin, such as cat, therefore waits indefinitely instead of receiving EOF.

Prompt To Fix With AI

This is a comment left during a code review.
Path: sdk/rust/lib/sandbox/exec.rs
Line: 513

Comment:
**Null stdin stays open on PTYs**

When an execution combines the default `StdinMode::Null` with `tty(true)`, this empty message reaches `close_stdin`, which only drops pipe stdin and leaves the PTY master open. A command that reads from stdin, such as `cat`, therefore waits indefinitely instead of receiving EOF.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    OCI[OCI bundle] --> Parse[Parse and validate config]
    Parse --> State[Create durable OCI state]
    State --> Lifecycle[Validate lifecycle operation]
    Lifecycle --> Guest[Execute guest process]
    SDK[SDK exec options] --> Stdin[Build initial stdin messages]
    Stdin --> Guest
    Guest --> Exit[Report conventional exit status]
    Guest --> Diagnostics[Capture startup stderr tail]

Loading

_{Reviews (2): Last reviewed commit: "fix(exec): send EOF for non-interactive ..." | Re-trigger Greptile}