Avoid serial console readiness dependency for systemd guests

[sjmiller609]

Summary

• stop forwarding Hypeman-injected systemd service stdout/stderr to the serial console
• add a guest-agent vsock readiness fallback when the serial ready marker is missing
• cover the fallback and journal-only systemd unit behavior with tests

Validation

• go test -tags containers_image_openpgp ./lib/instances -run 'Test(HydrateBootMarkers|ParseBootMarkers|DeriveRunningState)'
• GOOS=linux GOARCH=amd64 go test -c -o /tmp/hypeman-init.test ./lib/system/init
• git diff --check
• git ls-files '*.go' | xargs gofmt -l

---

Note

Medium Risk
Changes when VMs transition from Initializing to Running and how readiness is persisted; incorrect probes could mark guests ready too early, though the exec path matches existing fork readiness checks.

Overview
Systemd guests no longer mirror Hypeman-injected unit logs to the serial console: hypeman-agent and kernel-headers units now log to the journal only (journal instead of journal+console).

Instance readiness can still reach Running when the serial HYPEMAN-AGENT-READY marker is absent: after program-start is known, boot-marker hydration and persistence run a vsock probe (/bin/true via the guest agent, injectable for tests) and set GuestAgentReadyAt on success.

Tests cover the probe fallback and the journal-only unit definitions.

^{Reviewed by Cursor Bugbot for commit 91cd43e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies guest system initialization and boot behavior, not kernel API endpoints or Temporal workflows as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.