Productionize the tls-virt deliveries

[lann]

The tls-virt crates (tls-virt-common, tls-virt-guest, tls-virt-wasmtime) were promoted out of experimental/ with their behavior unchanged; this issue tracks the gaps between that behavior and production use. Each crate README lists its limits; this is the actionable union.

Both deliveries:

• Configurable trust roots — both currently bake rust/quinn/tests/testdata/ca.der at compile time. Needs a design ruling: the guest delivery has no configuration surface by design (a virtualizer is composed, not configured), so roots plausibly arrive by composition-time embedding or a dedicated import; the wasmtime delivery can take a CLI flag.
• ALPN: not offered on tunneled connections. Decide whether transparent tunneling should offer anything (and what the app-invisible answer means).
• Socket options set on a tunneled socket do not reach the tunnel transport (guest: set before connect are not migrated; wasmtime: they land on the parked placeholder socket). Either migrate the meaningful ones or return not-supported explicitly.

tls-virt-guest:

• get-address-family on a tunnel reports IPv6 regardless of the real transport family.
• listen is unsupported (wrapping accepted nominal resources needs a resident task no export on that path can host). Revisit if an upstream mechanism appears.

tls-virt-wasmtime:

• An address policy for tunneled connects: wasmtime-wasi's SocketAddrCheck is pub(crate) and the tunnel transport is native tokio, so tunneled connects bypass the sandbox address check today. The embedding needs its own policy knob (or an upstream API to run the configured check).
• The 0.2.x sockets registered by p2::add_to_linker_async are unwrapped; a guest importing p2 sockets bypasses the tunnel. Wrap them or register p2 without sockets. (Wrapped in e6eb1dc; the 0.2 tunnel path also enforces the sandbox address check.)

[lann]

e6eb1dc interposes wasi:sockets@0.2.x in tls-virt-wasmtime (checklist item ticked): both generations now route through the handle table, and a plain std::net Rust guest (examples/tls-virt-demo-p2) exercises the 0.2 tunnel end to end in the smoke rig.

Partial progress on the address-policy item, not ticked: 0.2 tunneled connects now run the sandbox check against the real destination (Network::check_socket_addr is public), but the 0.3 path still bypasses it (SocketAddrCheck remains pub(crate) with no equivalent seam on the p3 surface). The remaining work there is 0.3-specific.