Set OverrideUID on virtiofs mounts for macOS ownership

On macOS, libkrun's virtiofs FUSE server reports host-side file
ownership to the guest. Without user.containers.override_stat
xattrs, workspace files appear as the host UID (e.g. 501) and
the sandbox user (1000) cannot write to nested directories or
files.

Set OverrideUID/OverrideGID on both the workspace mount and extra
mounts (git objects). go-microvm walks the host path and sets the
xattr on all entries before VM boot, making them appear as owned
by the sandbox user inside the guest.

Requires go-microvm with SetOverrideStatTree support (unreleased).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jhrozek

internal/infra/vm/runner.go

@@ -306,8 +306,10 @@ func (r *MicroVMRunner) Start(ctx context.Context, cfg domvm.VMConfig) (domvm.VM
 			return nil, fmt.Errorf("resolving workspace path: %w", err)
 		}
 		opts = append(opts, microvm.WithVirtioFS(microvm.VirtioFSMount{
-			Tag:      "workspace",
-			HostPath: absPath,
+			Tag:         "workspace",
+			HostPath:    absPath,
+			OverrideUID: sandboxUID,
+			OverrideGID: sandboxGID,
 		}))
 	}