fix(example): native-client uses current CreateVmConfig (unblocks CI)

[NathanFlurry]

What

The native-client example failed to type-check after the "CreateVm → typed JSON config" migration:

examples/native-client/src/index.ts(15,3): error TS2353: Object literal may only specify known properties, and 'metadata' does not exist in type '{ runtime: GuestRuntimeKind; config: CreateVmConfig; }'

This is a pre-existing build break on main, surfaced by the pnpm CI fix that now actually type-checks the workspace examples.

Why it broke

createVm's second argument changed from a flat { runtime, metadata } shape to { runtime, config: CreateVmConfig }. The old per-VM metadata field no longer exists on CreateVmConfig — session metadata now lives on authenticateAndOpenSession(metadata), which the example already passes ({ example: "native-client" }). The example was simply never updated to the new config shape.

Change

Replace the stale metadata object on createVm with a minimal valid CreateVmConfig (ephemeral root filesystem over the bundled base filesystem, empty env, no loopback-exempt ports). Session metadata is unchanged and still passed to authenticateAndOpenSession. Diff is limited to the example.

Verification

• pnpm --filter @secure-exec/example-native-client build (tsc) — green
• pnpm check-types across the workspace — 59/59 packages pass

[railway-app]

🚅 Environment secure-exec-pr-84 in rivet-frontend has no services deployed.