Add integration tests based on VM

docs/RUNTIME.md

@@ -138,11 +138,14 @@ the runtime or service adapters.
 Application unit tests use private fake adapters and an injected private
 monotonic clock. Public integration tests exercise cancellation, preview,
 restore, and saved-setting selection without confirming a host restart. These
-are synthetic fixture results. The Linux transport has not been validated
-against a real interface; that check belongs to the isolated Alpine suite at
-M8. The real zbus/systemd path and end-to-end restart acceptance require the
-disposable systemd VM at M9. The TUI and management startup wiring are not
-implemented.
+are synthetic fixture results. M7 implemented the TUI and management startup
+wiring, with synthetic workflow and PTY coverage. M8 also validated the Linux
+Rustix transport against a real WireGuard interface in the isolated Alpine
+fixture, including IPv4 peer, route, handshake, and counter observations (see
+[M8 evidence](evidence/milestone-8.md)). That fixture does not exercise the
+real zbus/systemd path: systemd/D-Bus behavior and end-to-end restart acceptance
+still require the disposable VM at M9. Real IPv6 capability and traffic remain
+unverified.
 
 ## Bounded Linux transport
 
@@ -164,5 +167,7 @@ errors, timeouts, and limit excess remain separate, redacted categories.
 Receive buffers are zeroized on every return path because device replies may
 include private and preshared key attributes, although the decoder borrows and
 does not retain those attributes. Runtime observation does not itself perform
-saved-peer comparison or mark state applied. Real-interface behavior remains
-subject to the isolated Alpine integration milestone.
+saved-peer comparison or mark state applied. M8 exercised this Rustix reader
+against a real Alpine WireGuard interface for IPv4 observations; real IPv6
+capability and traffic remain unverified. See [M8 evidence](evidence/milestone-8.md)
+for the accepted scope.