fix(deps): align Hyperlight 0.17 and hyperlight-js 0.4.0

[simongdavies]

Summary

• Combine the Hyperlight 0.17.0 dependency updates from chore(deps): Bump hyperlight-host from 0.16.0 to 0.17.0 in /src/code-validator/guest #337, chore(deps): Bump hyperlight-guest from 0.16.0 to 0.17.0 in /src/code-validator/guest #338 and chore(deps): Bump hyperlight-guest-bin from 0.16.0 to 0.17.0 in /src/code-validator/guest #339 in the analysis workspace and regenerate its lockfile together, eliminating mixed 0.16/0.17 guest dependencies.
• Adapt both embedded guest binary constructors to GuestBinary::Buffer(Vec<u8>), required by hyperlight-host 0.17.0.
• Update the sandbox runtime to hyperlight-js-runtime 0.4.0 (superseding chore(deps): Bump hyperlight-js-runtime from 0.3.3 to 0.4.0 in /src/sandbox/runtime #345) and the source-built host addon to the matching v0.4.0 release tag in Justfile.
• Regenerate the sandbox Cargo lockfile, update the npm addon lock metadata, and correct the analysis workspace comment to describe the hyperlight-js 0.4.x / Hyperlight 0.17 alignment.

CI investigation and validation

#338 and #339 fail with guest-function trait mismatches from mixed Hyperlight versions. #337 fails at both guest buffer constructors with expected Vec<u8>, found &[u8].

All CI checks pass on final commit 44436ba, including the hyperlight-js 0.4.0 update: Validate Pull Request run. This covers Linux KVM and MSHV debug/release, Windows WHP debug/release, lint and tests, Windows Clippy, PDF visual regression, and Docker build. CodeQL and DCO also pass.

Local Rust formatting and version/lock metadata consistency checks pass. Local just build and just check are blocked by a Windows linker output-path failure building Hyperlight's surrogate. Automatic npm lockfile regeneration also encounters an unavailable pre-existing @napi-rs/cli@^3.9.0 dependency on the local registry mirror; only the local addon version metadata was adjusted, and its metadata was compared with the pinned release manifest.

Future Hyperlight Dependabot version-update grouping is proposed separately in #350.

Closes #337
Closes #338
Closes #339
Closes #345

[Copilot]

🟡 Changes recommended

The updated dependency pinning makes an existing Cargo.toml comment misleading relative to the still-0.16 hyperlight-js runtime workspace, and it should be corrected to avoid confusion.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the code-validator analysis guest workspace to use a consistent set of Hyperlight 0.17.0 crates, regenerates the workspace lockfile to remove mixed 0.16/0.17 dependencies, and adapts the analysis-host sandbox construction to the hyperlight-host 0.17.0 breaking change where GuestBinary::Buffer must own a Vec<u8>.

Changes:

• Bumped hyperlight-{guest,guest-bin,host} in the analysis guest workspace to 0.17.0 and regenerated Cargo.lock to eliminate mixed-version resolution.
• Updated both embedded guest binary construction sites to GuestBinary::Buffer(ANALYSIS_RUNTIME.to_vec()) to match the new Vec<u8> ownership requirement.
• Left the separate sandbox/hyperlight-js runtime workspace unchanged.

File summaries

File	Description
src/code-validator/guest/host/src/sandbox.rs	Updates embedded guest binary construction to pass an owned Vec<u8> into GuestBinary::Buffer.
src/code-validator/guest/Cargo.toml	Aligns analysis-workspace Hyperlight crate versions to 0.17.0.
src/code-validator/guest/Cargo.lock	Regenerates lockfile to remove mixed 0.16/0.17 Hyperlight dependencies and reflect new transitive deps.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.