Speed up guest-agent exec readiness retries

[sjmiller609]

Summary

• add guest exec tracing for WaitForAgent readiness paths so restore/fork hot paths expose total wait time, retry counts, retry interval config, and first/last retryable error type
• keep normal no-wait execs out of this new tracing path because API exec already has its own session span
• keep one retry behavior; no fast/slow mode
• replace the old fixed 500ms wait-for-agent retry sleep with 25ms retries for the first 2s, then 250ms retries until the existing timeout
• drop the pooled grpc connection after retryable guest-agent connection failures so retries create a fresh vsock/grpc path instead of reusing a connection in grpc backoff
• aggregate retry data on the parent guest.exec span instead of emitting a child span per retry attempt
• keep the shared test exec-readiness helper on explicit test-level polling instead of using WaitForAgent internally
• update the VZ standby test to wait for instance state Running before calling standby, instead of relying on exec readiness as a lifecycle-state proxy
• record only the command basename in trace attributes to avoid capturing shell arguments or env content
• add coverage for retry interval selection, command-name sanitization, and fresh-connection retry behavior

Testing

• go test ./lib/guest ./lib/hypervisor
• git diff --check

---

Note

Medium Risk
Touches core guest vsock/gRPC exec and connection pooling on boot/restore hot paths; behavior change is intentional but affects all WaitForAgent callers.

Overview
Guest exec readiness is faster and easier to observe when WaitForAgent is set (restore/fork/API paths that wait for the agent).

Retry backoff replaces a fixed 500ms sleep with 25ms for the first 2s, then 250ms until the existing deadline. On retryable vsock/gRPC-unavailable errors, the pooled connection is removed and closed so the next attempt dials fresh instead of sitting in gRPC backoff.

OpenTelemetry adds a guest.exec span only for WaitForAgent > 0 (single-attempt exec stays untraced to avoid duplicating API exec.session spans). The span records wait time, attempt counts, retry intervals, first/last retryable error types, and command basename only (no argv/env).

Tests: new unit tests for retry timing, sanitized command names, fresh-connection retries, and CloseConn behavior; integration helpers stop nesting WaitForAgent inside waitForExecAgent, and the VZ standby test waits for Running before standby.

^{Reviewed by Cursor Bugbot for commit d53eb85. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies guest-agent execution logic and tracing in packages/api/lib/guest and packages/api/lib/hypervisor, not the kernel API endpoints or Temporal workflows specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b5f21d. Configure here.}