> Does the Xen or KVM ecosystems provide anything comparable to Windows hypervisor-enforced code integrity?

Xen can do it, KVM had some attempts at memory enforcement patches, but not sure where it ended up. I'm not sure how well utilised it is though from the guest side ootb. (I think poorly)

A lot of the signing/module loading issues are prevented on the guest side though with https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html

So it's... not the same, but the facilities are available. (Unless someone wants to correct me and it's already used)