os: add experimental reproducible Debian/mkosi backend

[kvinwang]

Summary

• add an experimental Debian trixie/mkosi guest OS backend
• pin Debian snapshot, Linux 7.1.4 source checksum, and EDK2 stable-202502 revision
• reuse the TDX DMA and ACPI BadAML/SystemMemory hardening patches from meta-dstack
• align explicit kernel features with the Yocto guest configuration
• export artifact-manifest v1 and use the common os/image/assemble.sh release path
• produce the Yocto-compatible bare-metal and UKI layouts, dm-verity rootfs, and TDX/GCP/AWS measurement material

Validation

• ./os/mkosi/build.sh lint
• clean Linux 7.1.4 kernel build with both dstack patches
• pinned Intel TDX OVMF build
• complete prod rootfs and release assembly
• artifact schema, checksum, dm-verity, GPT label/GUID and tar layout checks
• generated dstack-0.6.0.tar.gz and dstack-0.6.0-uki.tar.gz
• QEMU UKI smoke test reached verified-root mount, switch_root, and Debian systemd

Notes

This remains experimental. Package contents are Debian rather than Yocto, while the external release contract and file/partition layout are shared with the Yocto backend.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kvinwang]

Reproducibility/clean-build follow-up pushed as c83948eb3.

Verified with the exact full two-clean-build gate:

JOBS=16 ./os/mkosi/build.sh repro-check os/mkosi/build-repro-final
...
Yocto functional parity paths accepted       # work-a
Yocto-compatible release format accepted     # work-a
Yocto functional parity paths accepted       # work-b
Yocto-compatible release format accepted     # work-b
reproducibility check passed
Elapsed: 35:28.42, exit status 0

The two dstack-0.6.0.tar.gz outputs are byte-identical. The fixes cover deterministic kernel/in-tree BTF, NVIDIA and ZFS external modules, nvattest Rust/C++, dstack Rust binaries, NVIDIA container tooling, fixed dm-verity UUID/salt, removal of the traversal-dependent ldconfig cache, stable absolute mkosi paths, and clean-build Sysbox/OVMF path handling.

Additional gates rerun successfully:

• mkosi static acceptance / functional parity
• full output format and dm-verity artifact checks in both clean builds
• prek run --all-files
• exact PR range prek command
• shellcheck
• REUSE is clean for the tracked tree; the only local reuse lint complaint remains the user's unrelated untracked docs/security/advisories/luks2_tamper.py, which was not touched or added.

[kvinwang]

Post-push QEMU smoke test also passed the intended platform-independent portion on the final reproducible disk.raw: Linux 7.1.4-dstack, dm-verity mapping and verified-root mount, var-volatile.mount, volatile bind setup, and dstack-firstboot.service all succeeded. Boot then stopped at the expected bare-QEMU boundary: no dstack-data partition and no /dev/vdb (dstack-prepare reported exactly that). Log: /tmp/mkosi-qemu-repro-final.log.