[CMGS]

Problem

A host reboot removes every network namespace and TAP device, while the VM record and disks survive. After that, every vm start of a VM whose networking cocoon-macos created (--net cni, or the bridge/tap auto modes) fails before QEMU runs. launch enters the persisted netns and opens the persisted TAP, and nothing rebuilds them. The unquiesce after start is a no-op when the netns is missing. The only way out today is vm rm plus recreate.

Fix

launch now checks the VM's owned NIC through the cocoon network provider before it starts QEMU. When the provider's Verify fails, launch runs Prepare and then Add with AddRecover. This is the same recovery cocoon runs for its own VMs at start.

• The NIC keeps its MAC. For CNI, that is the MAC set on the in-netns interface.
• The provider's existing network record is reused.
• The rebuilt TAP name and netns path are written back into the VM record before it is saved.
• A failed rebuild fails the start instead of launching a guest with half-built networking.
• A VM with a user-supplied --tap is untouched.
• Provisioning and recovery now share one single-queue VM config, so the recovered TAP keeps the queue layout QEMU's -netdev tap expects.

The new TestStartChecksOwnedNetworkBeforeQEMU checks that starting an owned-network VM goes through the provider first and fails before QEMU when that check fails.

Evidence

$ GOWORK=off make lint
==> golangci-lint GOOS=linux
0 issues.
==> golangci-lint GOOS=darwin
0 issues.

$ GOWORK=off make fmt-check
FMTCHECK rc=0

$ GOWORK=off go test -race -count=1 ./...        # darwin
ok  	github.com/cocoonstack/cocoon-macos/cmd	1.303s
ok  	github.com/cocoonstack/cocoon-macos/cmd/image	1.540s
ok  	github.com/cocoonstack/cocoon-macos/cmd/vm	2.344s
ok  	github.com/cocoonstack/cocoon-macos/home	2.007s
ok  	github.com/cocoonstack/cocoon-macos/qemu	2.303s
NO-FAIL-LINES

$ go test -race -count=1 ./...                   # golang:1.27 container, go1.27.1 linux/arm64
ok  	github.com/cocoonstack/cocoon-macos/cmd	1.018s
ok  	github.com/cocoonstack/cocoon-macos/cmd/image	1.018s
ok  	github.com/cocoonstack/cocoon-macos/cmd/vm	6.589s
ok  	github.com/cocoonstack/cocoon-macos/home	1.019s
ok  	github.com/cocoonstack/cocoon-macos/qemu	1.195s
NO-FAIL-LINES
--- PASS: TestStartChecksOwnedNetworkBeforeQEMU (0.03s)

$ GOOS=linux asl ./...
ASL-LINUX rc=0
$ GOOS=darwin asl ./...
ASL-DARWIN rc=0

# mutation check: recovery call removed from launch, same container
    net_linux_test.go:95: Start error = launch qemu: exec: "qemu-system-x86_64": executable file not found in $PATH, want the network recovery failure before qemu launch
--- FAIL: TestStartChecksOwnedNetworkBeforeQEMU (0.02s)

Notes

• Pending Linux verification. The actual netns and TAP rebuild after a host reboot has not been exercised yet. It needs a Linux host with CNI plugins and a bridge. This change is verified by unit tests and static gates only.
• The CNI address may change. No guest IP is persisted, so a rebuilt CNI NIC takes a fresh lease from the IPAM plugin. The guest may come back with a different address.
• A missing bridge now fails the start. Starting an owned bridge-mode VM now builds the bridge provider, which requires the bridge device to exist. If it is missing, start fails with recover network: bridge <dev>: ... instead of launching QEMU on a TAP with no bridge.