Opt-in privileged shells via AWS additionalOsCapabilities

[udgover]

What

Adds support for AWS Lambda MicroVM Operating system capabilities — throwaway shells that can mount filesystems, create network namespaces, run eBPF, and nest containers, none of which a root shell can do under the default restricted capability set.

whim --privileged                 # throwaway shell with ALL OS capabilities
whim run --privileged -- mount -t tmpfs none /mnt
whim build ./app --name whim-app --privileged   # bake caps into a custom image

Privilege is opt-in: default images stay minimal-cap and it is never granted implicitly.

How

• Library: a forward-compatible []Capability (only CapabilityAll = "ALL" is accepted today) threaded through ImageSpec / BuildFromSourceOptions → awsapi → the SDK's additionalOsCapabilities.
• CLI: a truthful boolean --privileged. whim --privileged / whim run --privileged launch the well-known whim-privileged image — auto-built on first use like whim init, shipping the tooling to use the caps (util-linux, iproute, e2fsprogs), and mutually exclusive with --image.

Correctness & hardening

• Capabilities are part of the reuse contract. reuseImage compares an existing version's caps (via a new GetMicrovmImageVersion) against the request and refuses a mismatch (ErrCapabilityMismatch) — a privileged build never reuses an unprivileged image or vice versa, and whim --privileged verifies a cached ARN is actually privileged before reuse.
• Validate before destroy. validateImageSpec (required fields + capabilities + egress) runs before any destructive/AWS action, so an invalid or incomplete spec never costs the caller their image on ForceRebuildImage's delete.
• Bounded, quiet auto-build. First-use privileged build is bounded by imageBuildTimeout and streams progress to stderr, keeping whim run stdout limited to remote output.
• whim image rm now prunes the deleted image's config entry.

Validation

• Unit: capability mapping, both reuse-mismatch directions, dedup set-compare, validate-before-delete (fields/caps/egress), and the cached-privileged decision (reuse / rebuild / refuse). Full go test ./... green; go vet and gofmt clean.
• Live (us-east-1): an ["ALL"] image reaches CREATED/ACTIVE; a privileged shell performs mount/ip netns/unshare (CapEff 000001ffffffffff) while an identical unprivileged shell is denied (a80425fb); and a non-privileged build over the privileged image is refused.

Out of scope (documented)

Baked/snapshotted Docker daemon, per-capability granularity (AWS supports only ALL), and auto-upsizing disk/memory for nested workloads.