nfstest: migrate local integration test to Apple containers

[kchiu]

What this changes

The local NFS integration test (make nfstest) now runs entirely on
Apple's container runtime. Previously
it needed three different tools stitched together — Earthly to build a
Docker image, Docker to run the server, and a QEMU virtual machine
(booted from a downloaded Alpine image + cloud-init) to act as the NFS client,
reached over SSH. This replaces all of that with two plain containers.

Why

make nfstest checks that the Arctic Wolf NFS server actually works against a
real Linux NFS client (the upstream nfstest_posix suite). To do that you need
a Linux machine that can mount -t nfs. On a Mac the old setup spun up a full
QEMU VM for this. Apple's container runtime can run Linux containers natively
on macOS, each with its own IP address, so we can run both the server and the
client as lightweight containers and skip the VM, Docker, and Earthly entirely.

How it works now

make nfstest starts two containers on the default 192.168.64.0/24 network:

1. Server — the Arctic Wolf NFS server.
2. Client — runs nfstest_posix, mounts the server's /data export, and
   runs the POSIX read/write tests against it.

make nfstest                     # run the test (read,write)
make nfstest TESTCASE=read       # pick which POSIX cases to run

The one tricky part: a custom kernel

Apple's default container kernel is built without the in-kernel NFS client
(CONFIG_NFS_FS is off, and it has no loadable-module support), so a container
simply cannot mount NFS out of the box — mount -t nfs fails with
No such device.

To fix this, the client container boots a custom kernel: we take Apple's own
kernel config (extracted from a running container) and rebuild the same kernel
version with the NFS v3 client compiled in. This is a one-time, cached build:

make nfstest-kernel              # builds nfstest/kernel/out/Image (cached)

The compiled kernel binary (~16 MB) is gitignored; the config it's built from
is committed so the build is reproducible.

File guide

Path	Purpose
nfstest/server/Dockerfile	Builds the Arctic Wolf server image
nfstest/client/Dockerfile	Builds the nfstest client image
nfstest/kernel/	Builds the NFS-enabled kernel + Apple's base config
nfstest/config/arcticwolf.test.toml	Server config used by the test
nfstest/scripts/nfstest.py	Orchestration (build / start / test / stop)
Makefile	New targets: nfstest, nfstest-build, nfstest-kernel, nfstest-up, nfstest-down

Removed: the QEMU VM definition (nfstest/vm/), the SSH-based test runner
(nfstest/scripts/runner.py), and the Earthly server-docker / client-vm
targets.

Scope notes

• make build / test / lint are unchanged (still Earthly).
• GitHub Actions CI is untouched — it runs on Linux with its own Docker/k3s
  flow, and Apple container is macOS-only. This PR only changes the local
  developer test.

Test results

make nfstest passes end-to-end on macOS (Apple Silicon):

15 tests (15 passed, 0 failed)
NFS integration test PASSED ✓