tstest/natlab/vmtest: add macOS VM snapshot caching for fast test starts

Cache a pre-booted macOS VM snapshot on disk so subsequent test runs
restore from the snapshot instead of cold-booting. The snapshot is keyed
by the Tart base image digest and a code version constant
(macOSSnapshotCodeVersion); bumping either invalidates the cache.

Snapshot preparation (one-time):
- Boot the Tart base image with a NAT NIC (--nat-nic flag)
- Wait for SSH, compile and install cmd/tta as a LaunchDaemon
- TTA polls the host via AF_VSOCK for an IP assignment; during prep
  the host replies "wait"
- Disconnect NIC, save VM state via SIGINT

Test fast path (cached, ~7s to agent connected):
- APFS clone the snapshot, write test-specific config.json
- Launch Host.app with --disconnected-nic --attach-network --assign-ip
- VZ restores from SaveFile.vzvmsave (~5s with 4GB RAM)
- TTA's vsock poll gets the IP config, sets static IP via ifconfig
  (bypasses DHCP entirely), switches driver addr to the IP directly
  (bypasses DNS), and resets the dial context so the reverse-dial
  reconnects immediately
- TTA agent connects to test driver within ~2s of IP assignment

Key optimizations:
- 4GB RAM instead of 8GB: halves SaveFile.vzvmsave (1.4GB vs 2.4GB),
  halves restore time (5.5s vs 11s)
- AF_VSOCK IP assignment: bypasses macOS DHCP (~5-7s saved)
- Direct IP dial: bypasses DNS resolution for test-driver.tailscale
- Dial context reset: cancels stale in-flight dials from snapshot
- Kill instead of SIGINT for test VM cleanup (no state save needed)
- Parallel VM launches

Also:
- Add TestDriverIPv4/TestDriverPort constants to vnet
- Add --nat-nic and --assign-ip flags to Host.app
- Fix SIGINT handler: retain DispatchSource globally, use dispatchMain()
- Add vsock listener (port 51011) to Host.app for IP config protocol
- Add disconnectNetwork() to VMController for clean snapshot state
- Fix Makefile: set -o pipefail so xcodebuild failures aren't swallowed

Updates #13038

Change-Id: Icbab73b57af7df3ae96136fb49cda2536310f31b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

tstest/tailmac/Swift/Host/VMController.swift

@@ -81,7 +81,7 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         return macPlatform
     }
 
-    func createVirtualMachine(headless: Bool = false, disconnectedNIC: Bool = false) {
+    func createVirtualMachine(headless: Bool = false, disconnectedNIC: Bool = false, natNIC: Bool = false) {
         let virtualMachineConfiguration = VZVirtualMachineConfiguration()
 
         virtualMachineConfiguration.platform = createMacPlaform()
@@ -91,7 +91,10 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         virtualMachineConfiguration.graphicsDevices = [helper.createGraphicsDeviceConfiguration()]
         virtualMachineConfiguration.storageDevices = [helper.createBlockDeviceConfiguration()]
         if headless {
-            if disconnectedNIC {
+            if natNIC {
+                // NAT NIC for SSH access during snapshot preparation.
+                virtualMachineConfiguration.networkDevices = [helper.createNetworkDeviceConfiguration()]
+            } else if disconnectedNIC {
                 // Create a NIC with no attachment. The NIC exists in the hardware
                 // config (so saved state is compatible) but appears disconnected.
                 // Call attachNetwork() after restore to hot-swap the attachment.
@@ -120,6 +123,17 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         virtualMachine.delegate = self
     }
 
+    /// Disconnect the NIC by setting its attachment to nil.
+    /// Call before saving state so the snapshot has no active link.
+    func disconnectNetwork() {
+        guard let nic = virtualMachine.networkDevices.first else {
+            print("disconnectNetwork: no network devices")
+            return
+        }
+        nic.attachment = nil
+        print("disconnectNetwork: NIC attachment set to nil")
+    }
+
     /// Hot-swap the NIC attachment on a running VM. The VM must have been
     /// created with disconnectedNIC=true. After calling this, the guest
     /// sees the link come up and does DHCP.
@@ -157,6 +171,21 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         }
     }
 
+    /// Start a vsock listener that tells the guest TTA agent what IP to configure.
+    /// If response is nil, the listener replies "wait" (snapshot prep mode).
+    func startIPConfigListener(response: String) {
+        guard let device = virtualMachine.socketDevices.first as? VZVirtioSocketDevice else {
+            print("startIPConfigListener: no socket device")
+            return
+        }
+        let listener = IPConfigListener(response: response)
+        retainedIPConfigListener = listener
+        let vsockListener = VZVirtioSocketListener()
+        vsockListener.delegate = listener
+        device.setSocketListener(vsockListener, forPort: 51011)
+        print("startIPConfigListener: listening on vsock port 51011")
+    }
+
     func resumeVirtualMachine() {
         virtualMachine.resume(completionHandler: { (result) in
             if case let .failure(error) = result {
@@ -211,3 +240,28 @@ class VMController: NSObject, VZVirtualMachineDelegate {
         exit(0)
     }
 }
+
+// Global to prevent ARC deallocation of the vsock listener.
+var retainedIPConfigListener: IPConfigListener?
+
+/// Listens on vsock port 51011 for TTA connections and replies with
+/// an IP configuration JSON string (or "wait" during snapshot prep).
+class IPConfigListener: NSObject, VZVirtioSocketListenerDelegate {
+    let response: String
+
+    init(response: String) {
+        self.response = response
+    }
+
+    func listener(_ listener: VZVirtioSocketListener,
+                  shouldAcceptNewConnection connection: VZVirtioSocketConnection,
+                  from socketDevice: VZVirtioSocketDevice) -> Bool {
+        let fd = connection.fileDescriptor
+        let data = Array((response + "\n").utf8)
+        data.withUnsafeBufferPointer { buf in
+            _ = write(fd, buf.baseAddress!, buf.count)
+        }
+        connection.close()
+        return true
+    }
+}