feat: add --publish-socket for exposing a guest TCP port as a host unix socket

[luke]

What

--publish-socket HOST_PATH:GUEST_PORT on machine create makes a TCP port the
guest listens on reachable on the host as a Unix socket file — -p without the
host TCP listener. It completes the socket-bridge triple from smol-machines#656: expose
(guest unix socket → host), mount (host unix socket → guest), publish (guest
TCP port → host unix socket).

smolvm machine create --name api --publish-socket /tmp/api.sock:8080
smolvm machine start --name api
smolvm machine exec --name api -- ./serve --port 8080 &
curl --unix-socket /tmp/api.sock http://localhost/health

Why

Tools that embed smolvm as an engine want the only host-side reachability of
a guest service to be a socket file the caller owns (the colima
DOCKER_HOST=unix:// shape): no port collisions, no loopback exposure to other
local processes, file-permission access control for free. Guest workloads
overwhelmingly listen on TCP, so the unix↔unix bridges from smol-machines#656 don't reach
them without a shim inside the guest.

How

Publish rides the smol-machines#656 machinery end to end. A new SocketDirection::Publish
is host-side identical to Expose — dynamic vsock port, libkrun listens on the
host socket, stale file replaced at start, same 64-entry cap — and the guest
agent's serve_publish mirrors serve_expose, except each host connection
dials the guest port on loopback over TCP with a short connect timeout, so a
dial the guest firewall silently drops cannot pin the forwarder thread (a
refused connection still fails immediately). The shared relay is generic over the
stream type, so independent half-close carries across the TCP leg unchanged (a
FIN maps to shutdown(SHUT_WR)); a port with no listener behaves like an
expose target whose socket is missing — the connection is dropped and the host
client sees a reset, no start-order coupling. The launcher pipeline and
BootConfig carry no functional changes — doc comments updated only, no new
fields — so the cfg(not(unix)) initializers from the smol-machines#656 follow-up are
unaffected. The wire encoding extends naturally to port|publish|8080 with
parse-time and decode-time validation.

CLI grammar is host-first, matching -p HOST:GUEST and --mount-socket; the
spec splits on the last colon so host paths containing : keep working.

The AGENTS.md section added here also documents the two existing smol-machines#656 flags
(--expose-socket / --mount-socket), which were previously undocumented —
included so all three bridges are described in one place.

Tests

• protocol: publish round-trips the wire encoding; malformed publish targets
  (path, port 0, >65535) are skipped like other malformed entries
• agent: relay over a real unix↔TCP pair delivers a 256 KiB tail after a
  client half-close (plus the existing three relay tests)
• CLI: valid/invalid spec parsing, including a host path containing :
• integration (tests/test_ports.sh): HTTP round-trip through the published
  socket with an ss check that no process holds a host TCP listener on the
  published port; stale socket file replaced at start; no-listener fails fast
  and recovers once a listener appears
• E2E on Linux/KVM: curl round-trip through the published socket against a
  real guest HTTP server, 20 concurrent requests, half-close probes in both
  directions with byte-count asserts, ss proof that no process listens on
  the published ports, no-listener fail-fast plus recovery, and stop/start
  lifecycle — 13/13 passing
• E2E on macOS/Hypervisor.framework (Apple Silicon): same 13-assert suite, 13/13 passing (no-ss platform adaptations noted in the transcript)

Format/clippy/unit gates green on Linux; Windows cross-compile checked.

Possible follow-up

Three pieces of shared smol-machines#656 semantics are deliberately left out of this PR
and would make a natural follow-up hardening PR, since each touches the
existing expose/mount behavior too: an explicit ,mode= option (or tighter
default) for the host socket file, which today is created with the invoking
user's umask and not chmod'd, leaving access control to the host path's
directory permissions; surfacing a host-socket bind failure
(krun_add_vsock_port2 returning an error) as a hard launch error instead of
a warn-and-disable; and rejecting duplicate host paths across bridge
definitions, where today the last bind quietly wins.