fix: let nested-KVM vmlaunch succeed with Virtual NMIs

Self-test and Linux guest were failing VM-instruction error 7. Share a KVM-style control adjust, request PIN_VIRTUAL_NMIS, and stop intercepting guest #PF. Land isolated XNU/Python/KDE scaffolding off the boot path.

Co-authored-by: Cursor <cursoragent@cursor.com>

SYSTEM/LINUXAPP.CNF

@@ -11,3 +11,4 @@
 # 其它实例只经桌面图标启动，IDE tab 标签显示最近启动实例的 DISPLAY）。
 VSCODE|VSCode|/opt/vscode/bin/code|--no-sandbox --disable-gpu --user-data-dir /root/.vscode-data
 VSCODE2|VSCode2|/opt/vscode/bin/code|--no-sandbox --disable-gpu --user-data-dir /root/.vscode-data2 /root/workspace2
+PYTHON|Python|/usr/bin/env|-u LD_LIBRARY_PATH /usr/bin/python3 /usr/local/share/deshab/python/hello.py

SYSTEM/user/python/hello.py

@@ -0,0 +1,17 @@
+"""Minimal CPython readiness check for the Deshab Linux guest."""
+
+from __future__ import annotations
+
+import platform
+import sys
+
+
+def main() -> None:
+    version = " ".join(sys.version.split())
+    print("DESHAB_PYTHON_READY")
+    print(f"version={version}")
+    print(f"platform={platform.platform()}")
+
+
+if __name__ == "__main__":
+    main()