refactor(vm): make the host integration lane Bazel-owned end to end

.bazelrc

@@ -41,6 +41,18 @@ build:local --@rules_rust//rust/settings:extra_exec_rustc_flags=
 build:local --action_env=PATH
 build:local --test_env=PATH
 
+# The host-integration lane's guest build profile. The lane builds the d2b
+# host binaries that reach the guest through this config, named here
+# rather than at a call site so a contributor's exported Bazel profile
+# cannot change the guest closure: the guest image action realizes the
+# binaries this config produces, whatever the caller set.
+build:guest --config=local
+# The guest binaries are content-addressed inputs of the guest image, so a
+# caller-inherited action environment would change the guest closure. The
+# profile pins the environment those builds see, the same way the remote
+# profile pins it.
+build:guest --action_env=PATH=/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
 # Remote profiles use the d2b BuildBuddy workspace. Authentication is
 # the credential helper only. Direct API-key headers leak into BEP.
 build:remote --remote_executor=grpcs://d2b.buildbuddy.io

AGENTS.md

@@ -53,7 +53,7 @@ Use this index, then open the focused document instead of expanding this file.
 | Worktrees, review, PRs, merge, and disk hygiene | [`docs/contributing/workflow.md`](./docs/contributing/workflow.md), especially the [reviewed-head lifecycle](./docs/contributing/workflow.md#reviewed-head-pr-lifecycle) |
 | Changelog or commit grammar | [`docs/contributing/changelog-and-commits.md`](./docs/contributing/changelog-and-commits.md) |
 | Codegraph MCP server and agent usage | [`.omp/mcp.json`](./.omp/mcp.json) wires the server; see [Codegraph (MCP code intelligence)](#codegraph-mcp-code-intelligence) below for per-checkout init and tool guidance |
-| Gates, heavy lanes, and build profiles | [`docs/contributing/gates-and-lints.md`](./docs/contributing/gates-and-lints.md) |
+| Gates, validation lanes, and build profiles | [`docs/contributing/gates-and-lints.md`](./docs/contributing/gates-and-lints.md) |
 | Architecture and per-Guest/provider features | [`docs/contributing/architecture.md`](./docs/contributing/architecture.md) and [ADR 0015](./docs/adr/0015-daemon-only-clean-break.md) |
 | Critical subsystem invariants | [`docs/contributing/critical-subsystems.md`](./docs/contributing/critical-subsystems.md) |
 | Contributor orchestration and host distribution | [`d2b-gascity`](https://github.com/vicondoa/d2b-gascity) for orchestration and [`gascity.nix`](https://github.com/vicondoa/gascity.nix) for NixOS distribution and installation |
@@ -224,10 +224,12 @@ settings or claim atomic base binding.
   `make test-host-integration`. They may run alongside the `/etc/nixos`
   real-host switch, d2b startup, and Cloud Hypervisor Guest boot. U19
   converges their declarations and current inputs but does not run host
-  acceptance. The host-integration lane must inject its Bazel-built
-  `d2b`, `d2bd`, `d2b-broker`, activation/helper, resource-compiler, and
-  Wayland-proxy binaries through `D2B_HOST_TOOL_BUNDLE`; it must not rebuild
-  those binaries through Nix.
+  acceptance. The host-integration lane passes its Bazel-built `d2b`,
+  `d2bd`, `d2b-broker`, activation/helper, resource-compiler, and
+  Wayland-proxy binaries to the guest-image action as declared Bazel label
+  inputs; Nix must realize the guest closure around those binaries rather
+  than rebuild them. The lane is `//bazel/checks/vm:host_integration_lane_run`,
+  invoked by `make test-host-integration`.
 - Every code change ships a valid changelog entry or a fragment under
   [`changelog.d/`](./changelog.d/).
 - The retired repository-local contributor runtime has no ordinary-work

BUILD.bazel

@@ -172,6 +172,16 @@ filegroup(
     visibility = ["//visibility:public"],
 )
 
+# keep
+filegroup(
+    name = "completions_workspace_sources",
+    srcs = glob(
+        ["completions/**/*"],
+        allow_empty = True,
+    ),
+    visibility = ["//visibility:public"],
+)
+
 # keep
 filegroup(
     name = "examples_workspace_sources",
@@ -343,6 +353,7 @@ filegroup(
         "//packages/d2b-provider-host:cargo_workspace_sources",
         "//packages/d2b-provider-user:cargo_workspace_sources",
         "//packages/d2b-provider-test-controller:cargo_workspace_sources",
+        "//packages/d2b-test-vm-harness:cargo_workspace_sources",
         "//packages/d2b-resource-runtime:cargo_workspace_sources",
         "//packages/d2b-audit:BUILD.bazel",
         "//packages/d2b-broker-composition:BUILD.bazel",

Cargo.toml

@@ -95,6 +95,7 @@ members = [
     "packages/d2b-provider-command",
     "packages/d2b-provider-operation",
     "packages/d2b-provider-seccomp-profile",
+    "packages/d2b-test-vm-harness",
 ]
 
 [workspace.package]

MODULE.bazel

@@ -69,7 +69,15 @@ nix_packages.attr(
     attr = "python3",
     repo = "@nixpkgs",
 )
-use_repo(nix_packages, "nix", "nix_eval_jobs", "nix_unit", "python3")
+# The host-integration lane's emulator, taken from the same pinned nix
+# package set the guest image is realized from, so the emulator and the
+# guest stay at one nixpkgs revision.
+nix_packages.attr(
+    name = "qemu_kvm",
+    attr = "qemu_kvm",
+    repo = "@nixpkgs",
+)
+use_repo(nix_packages, "nix", "nix_eval_jobs", "nix_unit", "python3", "qemu_kvm")
 
 buildbuddy = use_extension("@toolchains_buildbuddy//:extensions.bzl", "buildbuddy")