OpenVMM CI: provision PCAT firmware for Linux KVM and MSHV tests

[ppenna]

Context

#135 tracks enabling the remaining backend-native OpenVMM VMM tests. All Linux PCAT cases are currently blocked before VM creation because native Linux hosts cannot resolve the proprietary Hyper-V PCAT BIOS.

Affected tests

Linux / KVM

• multiarch::openvmm_pcat_x64_freebsd_13_2_x64_boot_no_agent
• multiarch::openvmm_pcat_x64_freebsd_13_2_x64_iso_boot_no_agent
• multiarch::openvmm_pcat_x64_ubuntu_2404_server_x64_boot
• multiarch::openvmm_pcat_x64_ubuntu_2504_server_x64_boot
• multiarch::openvmm_pcat_x64_ubuntu_2504_server_x64_boot_heavy

Linux / MSHV

• multiarch::openvmm_pcat_x64_freebsd_13_2_x64_boot_no_agent
• multiarch::openvmm_pcat_x64_freebsd_13_2_x64_iso_boot_no_agent
• multiarch::openvmm_pcat_x64_ubuntu_2404_server_x64_boot
• multiarch::openvmm_pcat_x64_ubuntu_2504_server_x64_boot
• multiarch::openvmm_pcat_x64_ubuntu_2504_server_x64_boot_heavy

Reproduction

On prometheus32 (linux-kvm, baremetal) at NVX fcce88654f8cdf4b8065c83c1336eaceca9e9304 / OpenVMM b9603efc025867a64a66db625fe6275f82a3753a:

multiarch::openvmm_pcat_x64_ubuntu_2404_server_x64_boot
Failed to load packaged PCAT binary:
Failed to translate path to windows. Are you not on WSL?

The failure occurs before VM creation. cargo xflowey restore-packages --no-compat-igvm succeeds, but it does not materialize:

.packages/Microsoft.Windows.VmFirmware.Pcat.amd64fre/content/vmfirmwarepcat.dll

The public openvmm-deps archive does not contain PCAT firmware, and no provisioned vmfirmwarepcat.dll or vmfirmware.dll exists on either configured Linux bare-metal host. OpenVMM documentation notes that the Hyper-V PCAT BIOS is proprietary and is not redistributed by the project.

Required outcome

Provide an authorized, backend-native firmware path for Linux self-hosted runners without:

• committing or publicly redistributing the proprietary firmware;
• copying Windows system files into repository artifacts without an approved licensing model;
• adding Windows build toolchains to Linux runners;
• implicitly skipping selected tests when firmware is absent.

Acceptance criteria

• Runner provisioning documents and validates the authorized firmware source.
• Artifact resolution supplies an explicit Linux path instead of falling back to WSL path translation.
• Missing firmware fails early with a precise runner-prerequisite error.
• Each affected exact test passes ten consecutive bare-metal iterations on its backend.
• Required KVM and MSHV virtual-machine CI lanes pass without runtime skips.

Moved from #135.