Add CoCo guest components to dstack rootfs

[kvinwang]

Summary

• add Yocto recipes for the Confidential Containers guest components and a modern Kata agent with initdata/policy support;
• include the compatibility files required by Kata confidential guest-pull: default OPA policy, ocicrypt config, and a static pause bundle;
• install the CoCo/Kata pieces into dstack-rootfs;
• add docs/coco-k8s-testing.md with the Kubernetes/Kata TDX smoke-test workflow.

This moves Dstack-TEE/meta-dstack#78 into the unified dstack monorepo. Yocto recipes now live under os/yocto/layers/meta-dstack/, while the user-facing test guide lives under docs/.

Validation

• original branch: bitbake dstack-rootfs and a live kata-qemu-tdx Pod smoke test;
• migrated branch: reuse lint, prek run --all-files, and patch/path validation.

The original live test reached Running and logged:

• hello-from-dstack-coco
• Linux dstack-coco-mvp-test 6.18.24-dstack ... x86_64 GNU/Linux