feat(driver): bound guest admission and bridge reconnect proofs

[jiashuoz]

The microVM accept loop now claims its one boot connection before spawning a worker, closing refused peers inline without per-peer logs. This bounds worker allocation when an untrusted guest repeatedly dials the control socket; first-boot configuration and the one-connection guard remain intact.

Adds driver.AuthorizeGuestConnection, connecting the existing runner authorization callback to the guest challenge/proof stream: strict 4 KiB framing, shared codecs, expected session/attempt correlation, one five-second ceiling, caller/host cancellation, zero authority and closed streams on failure, fixed errors, and retained buffered bytes on success. It sends only the challenge; it does not publish acceptance/configuration or install a relay.

This draft depends on #115 and is stacked on feat/guest-reconnect-session; rebase/retarget after prerequisite merges. No shipping listener invokes the new helper and no capability is enabled. Fresh current configuration, instance/epoch-bound relay handoff, configuration redemption/readiness, cold lifecycle ordering and real VM/agent qualification remain integration gates.

Validation:

• Admission ordering and proof exchange reproduced failing before implementation, then passed.
• MicroVM/guest driver race suite passed; complete runner and relay race suites passed.
• Built runner artifact exercises real agent WebSocket and guest TCP streams: verified signed proof, wrong scope, revoked authority, wrong attempt and oversized proof; no accepted token/configuration sent by the helper.
• Local make verify used disposable PostgreSQL with Docker daemon tests explicitly disabled because the required image is absent. Its only failure was the previously observed latency cleanup timing case; that case passed in isolation. Build and vet passed separately.
• Final-head Linux CI passed the full make verify, non-root jail ownership, CLI/client race and fleet syntax gates. The built TCP/WebSocket probe passed again after CI.
• Independent and adversarial reviews passed with no required changes. Additional read-only adversarial probes covered blocked challenge writes and concurrent duplicate callbacks under race detection.

Commit: 7fa5fb4.

Contract, alternatives and integration limits are documented in docs/design/2026-10-01-guest-reconnect-transport.md. This is transport groundwork, not a claim of enabled live recovery or Phase B completion.