guestd: Launch workload from metadata

[t0gun]

Context

Once guestd can fetch metadata and core defines the runtime metadata contract, guestd needs to launch the configured workload as PID 1's supervised child.

Scope

• Parse workload launch configuration from MMDS metadata.
• Fork/exec the configured workload.
• Pass environment and working directory if included by the metadata contract.
• Keep PID 1 ownership of child process lifecycle clear.
• Fail fast with useful errors if launch configuration is invalid.

Acceptance Criteria

• guestd launches the workload described by metadata.
• Launch failure is visible through the existing log/control path.
• Child process ownership is clear and does not leave zombies.
• Unit tests cover pure metadata-to-launch-config parsing.
• CI remains green.

[t0gun]

Tracked by #9.