MicroVM binary pins and licence gate

Epic 5777 — MicroVM nodes. This child is the packaging slice of the architecture's **C5** (split by the planner critic): pins, licence gate, `.deb` contents. Upstream: PRD task 5778 `prd`, Architecture task 5779 `architecture`. ## Original requirement (verbatim) Epic Goal 10: "Everything the node needs comes from the `jaah` package (pinned `cloud-hypervisor`, `virtiofsd`, firmware) plus images the node downloads itself (stock Ubuntu cloud image, built into the base image on the node with cloud-init). No GPL binaries shipped in our package." PRD R14 Packaging: "The `jaah` .deb carries or pins `cloud-hypervisor`, `virtiofsd` and firmware (hypervisor-fw / OVMF) at exact versions with digests. The node downloads the stock Ubuntu cloud image itself and checks it against a pinned digest. The package ships no GPL-licensed binary." ## Approach (settled) **D29 / §4.8:** - `packaging/microvm-pins.toml`: `[[artifact]] id, url, sha256, licence, install_to`; node-fetched items marked `fetch = "node"`. - Shipped in the `.deb`: `cloud-hypervisor-static` v53.0 (Apache-2.0/BSD-3), `CLOUDHV.fd` (edk2, BSD-2-Clause-Patent), and `virtiofsd` extracted from a pinned Ubuntu `.deb` (Apache-2.0/BSD-3). Each fetched at package build by `tools/build_jaahd_bundle.py`, verified against sha256, installed under `/usr/lib/jaahd/microvm/`. - Node-fetched (`fetch = "node"`, pinned here, downloaded by C5c): the Ubuntu 24.04 (noble) cloud image (dated serial URL + sha256) and the Node.js LTS linux-x64 tarball (MIT). - New gate stage `tools/check_package_licences.py` (wired into `./dc check` / `tools/check.sh`): fails if any shipped binary's licence (recorded per pin, verified against the upstream LICENSE at bump time) is GPL. - nfpm Depends adds `dosfstools`, `mtools`, `nftables`, `acl`, `libseccomp2`, `libcap-ng0`. Do NOT add `qemu-utils` (GPL) as a dependency (D7). - Rejected (do not use): rust-hypervisor-firmware. The nfpm entries for the new units (`jaah-microvmd.service`, `jaah-microvm.path`, `jaah-microvm-converge.service`) are added by C5b alongside the units; this child owns only binaries, pins, licence gate and Depends. ## Acceptance criteria (verbatim) - AC-15 Packaging. Oracle: build the `.deb`. `dpkg -c` shows the pinned cloud-hypervisor / virtiofsd / firmware, or the package fetches them by pinned URL and sha256. A licence check of every shipped binary shows no GPL licence. A fresh node downloads the Ubuntu cloud image and verifies its digest. (The last sentence is C5c's node fetch + C12's live observation.) Credentials & reach: AC-15 (package build, licence check) — none beyond the worktree; network to github.com / cloud-images.ubuntu.com / launchpad for pins — **verified** (pinned release metadata was fetched during the architecture stage). AC-16 (`./dc check full`, Jaah Deploy dev) — forge login via `jaah-forge` (broker) — **verified** by the standard runner path. Out of scope: No GPL binary in the `jaah` package; do not vendor qemu (N5). No guest agent, custom guest kernel, image build pipeline or registry (N3). Do not touch static worktrees, port grid, co-located nodes (N1). Do not write microvmd, the network converge or image building (C5b/C5c). Epic: "retiring static worktrees, co-located nodes (Multi-Node Hosts), the port grid or user slots; Mac/Windows hosts; GPU passthrough; any change to pricing beyond moving products to KVM-capable instance families." Done means: - Build the `.deb`; `dpkg -c` lists `/usr/lib/jaahd/microvm/cloud-hypervisor`, `virtiofsd`, `CLOUDHV.fd` — cite the listing. - Each shipped binary's sha256 matches `microvm-pins.toml` — build step fails on a mismatch (show a test or a forced-mismatch run). - `python3 tools/check_package_licences.py` passes, and fails when a pin's licence is set to GPL-3.0 (test) — cite. - `dpkg -I` shows the new Depends and no `qemu-utils`. - `./dc check full` green on the PR (cite summary line); PR auto-merged and the Jaah Deploy for dev succeeds (AC-16).

MicroVM pins (CH v53.0, CLOUDHV.fd, noble virtiofsd; node-fetched noble image + Node 24) staged into the .deb with digest refusal; GPL licence gate; new Depends. #5037 + test fix #5046 merged; dev Jaah Deploy succeeded.