virtio/console: harden governed console and raw-FD coverage

[dills122]

What changed

• add a bounded, ignored-by-default console property corpus for directional queue/control IDs, descriptor direction, partial writes, zero-progress handling, queued backpressure, cancellation, and port lifecycle
• make TX shutdown terminate a queued zero-byte write instead of re-popping it, park zero-progress retries instead of busy-looping, and return ports to the inactive state after worker shutdown
• add no-guest raw-FD library-boundary tests for validation errors, caller-FD duplication, FD_CLOEXEC, identity, unlink state, caller close/reuse, and context-owned cleanup
• extend the governed verifier, Clippy, ASan, repetition, coverage, and workflow routes for the new corpus
• add a standalone no-network default-init probe that fails closed when the exact Linux sysroot/cross-toolchain is unavailable, while retaining the upstream macOS cross-compilation job as the PR build gate for that route

No public API changed. No path authority was added.

Why

The retained governed measurement had zero function and line coverage in both port.rs and process_tx.rs. Exercising those boundaries exposed two local lifecycle defects: a shutdown racing a queued backpressured descriptor could repeatedly re-pop it, and a shut-down port remained logically active after its workers were joined.

Coverage

Scope	Before	After
Four governed console files, functions	13/88 (14.77%)	37/88 (42.05%)
Four governed console files, lines	90/728 (12.36%)	298/733 (40.65%)
port.rs, functions	0/17	15/17 (88.24%)
port.rs, lines	0/137	111/137 (81.02%)
process_tx.rs, functions	0/4	4/4 (100%)
process_tx.rs, lines	0/91	82/96 (85.42%)

Remaining measured gaps are 2 functions/26 lines in port.rs and 0 functions/14 lines in process_tx.rs. governance/capsule-v1.19.4/coverage-followup.json retains the exact measurement.

Governed verification

• retained default corpus: 51 passed
• retained blk corpus: 53 passed, including the 2 existing raw-FD tests
• bounded console/property corpus: 4 passed
• raw-FD library-boundary corpus: 2 passed
• non-blk raw-FD integration target: compiled with 0 gated tests; the blk route still ran both tests
• governed Clippy: warnings denied; only the retained GuestMemory::try_access deprecation allowance
• shutdown interruption: 25/25 repetitions
• queued backpressure cancellation: 25/25 repetitions
• macOS arm64 AddressSanitizer: retained 51, bounded 4, and raw-FD 2 all passed
• five raw-FD mutations and four console restoration mutations caught
• Rustfmt and the exact retained Rust 1.97.1 formatting drift oracle passed
• source/header contracts, patch reconstruction, and reverse dry-run passed
• complete governed no-guest wrapper: passed

The exact five retained patch files and aggregate patch-set identity d19fd0ff159c699acccda2621519de45a09408bf3847b418ac34e02b79e805d5 are unchanged. Reconstruction starts at upstream 728df8125077d0db44265f6e997c72b81b65c015 and matches governed merge 4ea8d1de861ed1c0636fc800b6da8fb71a086aa5.

Default-init boundary and limitations

The governed wrapper is an offline library-only gate and passes completely. The standalone default-init probe remains fail-closed on this macOS environment because it has no pre-provisioned exact Linux sysroot; it did not download or bootstrap one. The existing upstream macOS cross-compilation workflow provisions that environment and runs make with the default Linux init blob, without guest execution, and must independently pass as the PR's build evidence for that route.

No VM or guest was created or run. This is not VMM transport, installed-product, backend/profile admission, Capsule product wiring, release, signing, firmware, kernel, Supervisor, or deployment evidence. Independent human and CODEOWNER review remain required, so this PR is draft.