pub fn command_line(verbose: bool, console: bool) -> StringExpand description
What the kernel is told at boot, and the only place it is decided.
mitigations=off: the guest is disposable and holds no secrets (the proxy substitutes secret placeholders host-side), so CPU vulnerability mitigations inside it buy nothing and cost cycles. A console is only named when something reads it — registering one costs the kernel a device probe plus the log replay, and a plain exec run has nowhere to show it (dmesg still works).
It is a function, not a literal inside the builder, because the command line is part of what a guest IS: a measurement has to state the same string the hypervisor is handed, and two spellings of it would be two guests.