openvmm: track feature/microvm/dev on microsoft/openvmm

[Pedro Henrique Penna (ppenna)]

Track OpenVMM from microsoft/openvmm feature/microvm/dev

The OpenVMM microVM work now lives in microsoft/openvmm. Its feature/microvm/dev branch and the feature/microvm/release/v1.0 to v2.2 branches carry the same commits as the nanvix/openvmm microvm/* branches. This PR takes the openvmm submodule from microsoft/openvmm feature/microvm/dev instead of nanvix/openvmm main.

• Pin: unchanged at d0bdbed8f6e3b86271277dc22658109e2e633b2d. That commit is the current tip of microsoft/openvmm feature/microvm/dev, and of nanvix/openvmm main and microvm/v2.2. It has a good SSH signature from ppenna@microsoft.com.
• OpenVMM review PR: none. feature/microvm/dev was published directly from nanvix/openvmm microvm/v2.2.
• Equivalence: the gitlink does not move, so the pinned commit and its tree (b10178aa5f61ab0fd1f2fb1c63847b41f4f42574) are byte-for-byte identical to dev's.
• Head submitted to CI: b75bd7c5729badc2c1334562181c607574e5c448, one commit on dev 77f84a4d8.

Changes

• .gitmodules: the URL is now https://github.com/microsoft/openvmm.git, and the tracked branch is feature/microvm/dev.
• checkout-openvmm action: it hard-coded nanvix/openvmm instead of following .gitmodules, so CI now checks out microsoft/openvmm. No secret changes are needed. CI already fetches OpenVMM over HTTPS with the job token because no OPENVMM_DEPLOY_KEY secret is set. The Checkout OpenVMM step of dev run 39319862129 shows the AUTHORIZATION: basic header.
• Specula adapter: resolve_nvx_tag rejects a release tag whose .gitmodules URL differs from source_url, and prepare_source requires the pin on source_branch. config.json therefore now names microsoft/openvmm and feature/microvm/dev. The README, the guidance, and the --ci-init target label match.
• Documentation that names the submodule's source: .github/copilot-instructions.md, doc/contribute.md, doc/project-structure.md, and aci_edge_sandboxes/README.md. doc/contribute.md now routes OpenVMM changes through pull requests to feature/microvm/dev.

Not changed: the unused OPENVMM_DEPLOY_KEY plumbing and its description in doc/ci.md, and the commit mapping in doc/openvmm-upstream-roadmap.md.

Follow-ups after merge

• Specula runner: ensure_bare refuses a cached repository whose origin differs from source_url. Before the next dispatch, run this once on the runner: git -C /mnt/data/openvmm-verification/repos/openvmm.git remote set-url origin https://github.com/microsoft/openvmm.git. Release tags that predate this change no longer pass the origin check.
• Existing checkouts keep fetching OpenVMM from nanvix/openvmm until someone runs git submodule sync -- openvmm. doc/contribute.md notes this.

Validation

Run locally on Windows at this head, with the submodule cloned from microsoft/openvmm:

• python scripts\nvx.py verify: pass.
• python scripts/check_markdown_links.py: pass.
• python -m ruff check scripts .github/specula: pass.
• Specula CI wiring tests (python3 -m unittest discover -s tests in .github/specula): 25 pass. They ran under WSL Ubuntu because they import fcntl.
• Specula's source_url and source_branch match .gitmodules, and the pin is on feature/microvm/dev ancestry.
• git diff --check: clean.

Left to CI:

• The full matrix, including the checkout-openvmm change on every platform.
• copilot-setup-steps, which initializes the submodule from .gitmodules.
• pyright, shellcheck, and shfmt. This change touches no Python or shell code.
• The KVM, MSHV, and WHP suites.

[Copilot]

🟢 Approval recommended

The coordinated source settings are consistent, the pinned revision is unchanged, and no blocking issues remain.

No open issues 🎉

What changed in this PR

Redirects NVX’s OpenVMM integration to microsoft/openvmm on feature/microvm/dev, preserving the pinned revision.

Changes:

• Updates submodule, CI checkout, and Specula source settings.
• Aligns documentation and contributor guidance with the new source.
• Documents URL synchronization for existing checkouts.

File	Description
doc/​project-structure.md	Updates the submodule source description.
doc/​contribute.md	Updates contribution routing and checkout migration guidance.
aci_edge_sandboxes/​README.md	Updates the dependency access reference.
.gitmodules	Sets the new repository URL and tracked branch.
.github/​specula/​README.md	Aligns source and ancestry-check descriptions.
.github/​specula/​guidance.md	Updates the verification target repository.
.github/​specula/​config.json	Updates source settings and target label.
.github/​copilot-instructions.md	Aligns repository guidance.
.github/​actions/​checkout-openvmm/​action.yml	Checks out OpenVMM from Microsoft’s repository.

_{Review effort: Balanced}