VM instances: sandbox host QEMU on macOS (hvf backend) #132

With the hvf backend (#131), qemu-system-aarch64 runs directly on the Mac as the HomeCloud user instead of inside the VM container. A QEMU escape (virtio devices, or the NBD client fed by passt / qemu-storage-daemon in the container) would land on the host rather than in a container.

Follow-up: run QEMU under a sandbox-exec profile limited to its run directory, the firmware and the docker exec relays, and document the trade-off in the VM docs.

Also from the review (low): an orphaned QEMU can survive until the next start of an instance if its runner dies while the container is stopped (macOS has no parent-death signal), and a second serial console session waits silently until the first closes.