Add seeded task workspace creation

Current persistent tasks started with an empty workspace, which blocked the first useful host-to-task workflow in the task roadmap. This change lets task creation start from a host directory or tar archive without changing the one-shot VM surfaces.

Expose source_path on task create across the CLI, SDK, and MCP, add safe archive upload and extraction support for guest and host-compat backends, persist workspace_seed metadata, and patch the per-task rootfs with the bundled guest agent before boot so seeded guest tasks work without republishing environments. Also switch post--- command reconstruction to shlex.join() so documented sh -lc task examples preserve argument boundaries.

Validation:
- uv lock
- UV_CACHE_DIR=.uv-cache uv run pytest --no-cov tests/test_vm_guest.py tests/test_vm_manager.py tests/test_cli.py tests/test_api.py tests/test_server.py tests/test_public_contract.py
- UV_CACHE_DIR=.uv-cache make check
- UV_CACHE_DIR=.uv-cache make dist-check
- real guest-backed smoke: task create --source-path, task exec -- cat note.txt, task delete

tests/test_vm_manager.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import io
 import json
 import subprocess
+import tarfile
 import time
 from pathlib import Path
 from typing import Any
@@ -306,6 +308,140 @@ def test_task_lifecycle_and_logs(tmp_path: Path) -> None:
         manager.status_task(task_id)
 
 
+def test_task_create_seeds_directory_source_into_workspace(tmp_path: Path) -> None:
+    source_dir = tmp_path / "seed"
+    source_dir.mkdir()
+    (source_dir / "note.txt").write_text("hello\n", encoding="utf-8")
+
+    manager = VmManager(
+        backend_name="mock",
+        base_dir=tmp_path / "vms",
+        network_manager=TapNetworkManager(enabled=False),
+    )
+
+    created = manager.create_task(
+        environment="debian:12-base",
+        allow_host_compat=True,
+        source_path=source_dir,
+    )
+    task_id = str(created["task_id"])
+
+    workspace_seed = created["workspace_seed"]
+    assert workspace_seed["mode"] == "directory"
+    assert workspace_seed["source_path"] == str(source_dir.resolve())
+    executed = manager.exec_task(task_id, command="cat note.txt", timeout_seconds=30)
+    assert executed["stdout"] == "hello\n"
+
+    status = manager.status_task(task_id)
+    assert status["workspace_seed"]["mode"] == "directory"
+    assert status["workspace_seed"]["source_path"] == str(source_dir.resolve())
+
+
+def test_task_create_seeds_tar_archive_into_workspace(tmp_path: Path) -> None:
+    archive_path = tmp_path / "seed.tgz"
+    nested_dir = tmp_path / "src"
+    nested_dir.mkdir()
+    (nested_dir / "note.txt").write_text("archive\n", encoding="utf-8")
+    with tarfile.open(archive_path, "w:gz") as archive:
+        archive.add(nested_dir / "note.txt", arcname="note.txt")
+
+    manager = VmManager(
+        backend_name="mock",
+        base_dir=tmp_path / "vms",
+        network_manager=TapNetworkManager(enabled=False),
+    )
+
+    created = manager.create_task(
+        environment="debian:12-base",
+        allow_host_compat=True,
+        source_path=archive_path,
+    )
+    task_id = str(created["task_id"])
+
+    assert created["workspace_seed"]["mode"] == "tar_archive"
+    executed = manager.exec_task(task_id, command="cat note.txt", timeout_seconds=30)
+    assert executed["stdout"] == "archive\n"
+
+
+def test_task_create_rejects_unsafe_seed_archive(tmp_path: Path) -> None:
+    archive_path = tmp_path / "bad.tgz"
+    with tarfile.open(archive_path, "w:gz") as archive:
+        payload = b"bad\n"
+        info = tarfile.TarInfo(name="../escape.txt")
+        info.size = len(payload)
+        archive.addfile(info, io.BytesIO(payload))
+
+    manager = VmManager(
+        backend_name="mock",
+        base_dir=tmp_path / "vms",
+        network_manager=TapNetworkManager(enabled=False),
+    )
+
+    with pytest.raises(RuntimeError, match="unsafe archive member path"):
+        manager.create_task(
+            environment="debian:12-base",
+            allow_host_compat=True,
+            source_path=archive_path,
+        )
+    assert list((tmp_path / "vms" / "tasks").iterdir()) == []
+
+
+def test_task_create_rejects_archive_that_writes_through_symlink(tmp_path: Path) -> None:
+    archive_path = tmp_path / "bad-symlink.tgz"
+    with tarfile.open(archive_path, "w:gz") as archive:
+        symlink_info = tarfile.TarInfo(name="linked")
+        symlink_info.type = tarfile.SYMTYPE
+        symlink_info.linkname = "outside"
+        archive.addfile(symlink_info)
+
+        payload = b"bad\n"
+        file_info = tarfile.TarInfo(name="linked/note.txt")
+        file_info.size = len(payload)
+        archive.addfile(file_info, io.BytesIO(payload))
+
+    manager = VmManager(
+        backend_name="mock",
+        base_dir=tmp_path / "vms",
+        network_manager=TapNetworkManager(enabled=False),
+    )
+
+    with pytest.raises(RuntimeError, match="traverse through a symlinked path"):
+        manager.create_task(
+            environment="debian:12-base",
+            allow_host_compat=True,
+            source_path=archive_path,
+        )
+
+
+def test_task_create_cleans_up_on_seed_failure(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_dir = tmp_path / "seed"
+    source_dir.mkdir()
+    (source_dir / "note.txt").write_text("hello\n", encoding="utf-8")
+
+    manager = VmManager(
+        backend_name="mock",
+        base_dir=tmp_path / "vms",
+        network_manager=TapNetworkManager(enabled=False),
+    )
+
+    def _boom(*args: Any, **kwargs: Any) -> dict[str, Any]:
+        del args, kwargs
+        raise RuntimeError("seed import failed")
+
+    monkeypatch.setattr(manager._backend, "import_archive", _boom)  # noqa: SLF001
+
+    with pytest.raises(RuntimeError, match="seed import failed"):
+        manager.create_task(
+            environment="debian:12-base",
+            allow_host_compat=True,
+            source_path=source_dir,
+        )
+
+    assert list((tmp_path / "vms" / "tasks").iterdir()) == []
+
+
 def test_task_rehydrates_across_manager_processes(tmp_path: Path) -> None:
     base_dir = tmp_path / "vms"
     manager = VmManager(