fix: preserve gVisor configuration across Lima restarts

[convee]

Summary

• Preserve existing containerd runtime and registry settings during repeated Lima provisioning.
• Add a stopped-VM-only migration for the exact legacy provision block, with saved-template readback.
• Document recovery without rebuilding the cluster or lowering runtime isolation.

Validation

• 51 focused tests: 50 passed, 1 Linux-only check skipped on macOS; all 8 new regression cases passed.
• Real existing VM migration and restart: containerd configuration and cluster CA hashes unchanged.
• Agent and Artifact Service pods can reach the independent Sandbox after restart.

No SDK revision or dependency pin changes. Existing operator changes are preserved; unknown provision blocks are rejected.