[Enrique Saurez (esaurez)]

Add the optional Transport::try_clone_handle API on Linux and Windows.
Native transports duplicate their existing peer-verified Unix socket or
overlapped named-pipe connection rather than reconnecting. The default
Ok(None) preserves compatibility for transports without native handles.

Document that callers must drop the blocking transport before using or
registering the duplicate, or changing the shared blocking mode. No async
runtime dependency, release version, lockfile, or existing deadline behavior
changes.

New tests cover the default fallback, independent handle ownership, reuse of
the same verified connection after the original transport is dropped, and
peer EOF after the last duplicate is dropped. The Linux test also removes
the listening endpoint before duplication. Existing tests are unchanged.

Validation

On Rust 1.95.0, with NVX_BUNDLE=skip except for the synthetic bundle fixture:

Configuration / test targets	Windows	Linux
All features	1,314 passed, 19 expected ignored	Library: 1,851 passed, 19 expected ignored; execution described below
cargo test --locked	1,078 passed, 17 expected ignored	1,048 passed, 19 expected ignored
cargo build --locked --lib --no-default-features and cargo test --locked --lib --no-default-features	270 passed	270 passed
Synthetic bundled-release fixture tests	18 passed	19 passed
Static-musl guest library	Not applicable	993 passed, 13 expected ignored

Counts include integration tests and doctests where the command runs them.
Also passed:

• The Windows steps of check-nvx-rs: formatting; all-feature/default/protocol
  Clippy with warnings denied; rustdoc with warnings denied; Rust 1.89 MSRV;
  and the independent runtime adapter's protocol-only and host-only matrix.
• Linux formatting, Clippy, rustdoc, MSRV, macOS cross-check, and the runtime
  adapter's protocol-only, host-only, and static musl guest-only matrices.
  The built static guest tools passed all 38 integration tests.
• All remaining Linux all-feature bin/integration/doctest targets and the
  four explicit pinned-source comparisons: 232 passed, 15 expected ignored.
  The remaining static-musl guest integration/doctest targets: 90 passed,
  4 expected ignored.
• Source verification, test layout, Markdown links, kernel inventory, and
  all four explicit comparisons with the pinned OpenVMM vectors/profiles.
• Independent correctness review of this candidate: no actionable findings.
• Copilot reviewed this head
  and recommended approval, with no open issues or review threads.

Linux kernel execution context

The local WSL 5.15 kernel lacks the semantics needed by three existing guest
tests: unique mount IDs and pidfd_open returning ESRCH for a reaped group
leader. These failures were reproduced on untouched dev, then all three
unchanged tests passed on the pinned Linux 6.18.38 kernel under local WHP.

The complete all-feature library used the same Cargo-built executable
in two exhaustive, disjoint groups:

• WSL host/core group: 1,116 passed, 6 existing ignored.
• WHP/Linux 6.18.38 guest:: group, including protocol guest-codec tests:
  735 passed, 13 existing ignored.

All 1,870 enumerated test names are accounted for; no test was omitted.
The host group runs where host /proc/*/io accounting and curl are available;
the guest group runs on NVX's actual guest kernel. Full static-musl guest
library coverage also passed there. Ordinary-user execution matches CI;
normal Unix device links, devpts, and fixture-directory prerequisites were
prepared only inside disposable test VMs.

No test assertions, capability guards, kernel configuration, or CI policy
were changed, and shared WSL configuration was untouched.

CI result

The full ready-triggered CI run
passed on a7318b77adad1e3f7e06873eea096bc2a883e365: all 34 selected jobs
succeeded, including both standard Rust matrices and Required status check.
The nine conditional skips match the existing pull-request/pin-selection
policy; none is an unexpected missing gate. This is the completed ready run,
not the earlier draft-skipped graph. Both requested reviews remain clean.

[Copilot]

🟢 Approval recommended

No active review issues remain for the optional native transport-handle changes.

No open issues 🎉

What changed in this PR

Adds optional native control-transport handles so asynchronous adapters can reuse NVX’s existing peer-verified connection without reconnecting or introducing an async runtime dependency.

Changes:

• Adds Transport::try_clone_handle and platform-specific owned handle aliases, with a default Ok(None) for compatibility.
• Implements Unix socket and Windows named-pipe duplication, documenting that the original transport must be dropped before using the duplicate.
• Adds tests for fallback behavior, independent ownership, connection reuse, and EOF after the last handle closes.

File	Description
nvx-rs/​src/​host/​platform/​windows/​endpoint/​tests.rs	Tests duplicated pipe ownership, connection reuse, and EOF.
nvx-rs/​src/​host/​platform/​windows/​endpoint.rs	Implements native pipe handle duplication.
nvx-rs/​src/​host/​platform/​tests.rs	Tests the default fallback for custom transports.
nvx-rs/​src/​host/​platform/​mod.rs	Defines the optional cloning API, handle aliases, and usage contract.
nvx-rs/​src/​host/​platform/​linux/​tests.rs	Tests socket duplication after endpoint removal, ownership, and EOF.
nvx-rs/​src/​host/​platform/​linux/​endpoint.rs	Implements native Unix socket duplication.
nvx-rs/​README.md	Documents native handles and adapter handoff requirements.

_{Review effort: Balanced}

[Pedro Henrique Penna (ppenna)]

LGTM