feat: in-cluster vm support

[chance-coleman]

Summary

Draft PR for team review and demonstration. Surfaces the approach and remaining product decisions before anything merges.

What's included

Core changes (land regardless of product decision):

• Native Pepr admission policy exceptions for KubeVirt virt-launcher and CDI-generated pods (scoped, not namespace-wide)
• spec.kubevirt.enabled on the UDS Package CRD; the operator labels the namespace automatically

New:

• packages/kubevirt/ — KubeVirt + CDI platform package with chart, tasks, and test suite
• bundles/k3d-kubevirt-dev/ — dev bundle extending k3d-slim-dev for local experimentation
• docs/concepts/core-features/virtual-machines.mdx and docs/how-to-guides/virtual-machines/ — full guide series following existing UDS Core doc patterns

Open questions (blocking merge)

• Does packages/kubevirt/ live in this repo or a separate product? The Pepr/CRD changes land in Core either way.
• First release flavor is unicorn. Non-unicorn flavors are paused pending the product boundary decision.

Testing locally

Full end-to-end demo on k3d (requires KVM or emulation mode):

# With real KVM
uds run kubevirt:demo

# Without KVM (nested virt / CI)
KUBEVIRT_USE_EMULATION=true uds run kubevirt:demo

This creates a k3d cluster, builds and deploys the bundle, and runs the full task suite (health check, container-disk VM, live migration, and the full UDS-managed VM app test).

Validation

Full task suite passes on a two-node k3d cluster with real KVM. CI runs with QEMU emulation. L2 networking, cross-cluster disk movement, and Windows VM platform mechanics are manually validated only.