feat(control): add ZoneSpec.vm_image for VM-image zones

V1 scope of the VM Image Support PRD. qcow2 launches with in-image backing files
disabled to keep the V1 trust boundary narrow.

Fixes edera-dev/protect#2878

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>

Author: 89luca89

protect/control/v1/common.proto

@@ -38,6 +38,10 @@ message ZoneSpec {
   string fork_parent_zone_id = 12;
   // Configures Control API access for the zone.
   ZoneControlApiSpec control_api = 13;
+  // Boots the zone from a disk image via UEFI firmware instead of the
+  // container path. KVM-only; mutually exclusive with `kernel`, `initrd`,
+  // `addons`, `scratch_disk` (rejected by the daemon).
+  ZoneVmImageSpec vm_image = 14;
 }
 
 // Access control specification on the Control API for a zone.
@@ -627,6 +631,22 @@ message ZoneScratchDiskSpecStaticBlock {
   string device = 2;
 }
 
+message ZoneVmImageSpec {
+  // Resolved against the daemon's VM-image directory; absolute paths and
+  // paths escaping it are rejected.
+  string path = 1;
+  // No autodetection: mitigates CHV format-probing CVE GHSA-jmr4-g2hv-mjj6
+  // (hardened in CHV v51.0).
+  ZoneVmImageFormat format = 2;
+}
+
+enum ZoneVmImageFormat {
+  ZONE_VM_IMAGE_FORMAT_UNSPECIFIED = 0;
+  ZONE_VM_IMAGE_FORMAT_RAW = 1;
+  // V1: launched with in-image backing files disabled.
+  ZONE_VM_IMAGE_FORMAT_QCOW2 = 2;
+}
+
 message ZoneDeviceStatus {
   repeated ZoneDiskStatus disks = 1;
   ZoneMountStatus mount = 2;