carlos / platform Public

Isolated exec, plan 4: the nested layout and `carlos layout migrate`/`revert` (#126)

Every exec tenant on a box has run "flat": a child of the edge, uid carlos,
in the edge's mount namespace with /data writable. Any tenant could read or
write every other tenant's database, env and config files, the box's
replication credentials and TLS keys, hijack sibling sockets, and kill
siblings or the edge. The nested layout gives each instance its own unit,
PID namespace and view of /data. This lands the box-side pass that moves
instances into it under a layout intent, journalled and recoverable, with a
revert path.

On top of the reviewed plan 4 work (branch isolated-exec-layout), this adds:

- The edge unit drops RestrictSUIDSGID=, which made openat2 return ENOSYS
  for the agent. instancefs.SelfCheck runs in the agent's own unit and is
  the nested gate's first question, so the blocker can't silently return.
- Migration can't be pre-planted by a flat tenant: unplanned entries in an
  instance's destination are quarantined to /data/layout/aside/<host>/,
  files with a second hard link are refused, and the result is checked
  again after the renames, before the row moves. Leftover env/corrupt
  files are kept outside every instance namespace, and a blocker at the
  aside path is displaced rather than taken as a reason to hold.
- An awake tenant can't defer its own migration forever. After a 1h grace
  it is stopped through the normal fence and moved. A move refused for a
  reason the tenant could have planted keeps the host fenced and down
  (held) until the reason clears. Holds are persisted and re-derived from
  the files at agent start, and retried every 10 minutes.
- `carlos status --layout` warns when a box runs nested instances beside
  flat, foreign or external ones, because nested isolation isn't in force
  there until none remain.

Nothing changes on a box until an operator records a nested layout intent.
Rollout (spec §8.6) needs separate approval. Plan 5 (the console door and
`--force`) follows.

Reviewed by Fable over five rounds (F1-F3, G1-G3, follow-ups, merge with
main); CI green on every tip. Pre-squash history: isolated-exec-layout and
tenant-iso-layout @468e4974.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>