Fence restored guest ownership and stream bounded process output

[Jesse McGinnis (brayzn)]

Restoring a guest snapshot can also restore the previous controller's live RPCs and processes. Add opt-in controller fencing so a newly admitted owner cancels and finishes the prior owner's RPCs, drains tracked process groups, and rejects stale calls. Authentication remains the responsibility of the router; ownership generations must come from outside the guest.

Also accept caller-generated process UUIDs for cancellation before a start response arrives; reject duplicate starts without replay; bound output messages to 64 KiB and drain the reaper's final output. Root filesystem operations with Go's os.Root, add rooted removal and process draining RPCs, and hold working-directory descriptors through Linux startup in ownership mode. Existing guest deployments retain their default ownership behavior. Go and Python protocol bindings are regenerated.

Validation: go test -race ./... passes. A Linux container integration using the compiled guest and grpc-js also passes owner handoff, stale writes, pre-start cancellation, process-group cancellation, streamed 5 MiB files, output limits, symlink escape rejection, and cold restart with workspace preservation.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.