nvx-rs slimming, phase 1.1: a checked public API, without NVX's programs #1077

Parent: #1076. Phase: 1, foundation. Needs: —. Unblocks: #1079, #1080, #1081, #1082, #1085, #1087, #1090.

Goal. CI checks nvx's public API against committed snapshots, and NVX's programs are hidden from it. Each binary keeps calling one #[doc(hidden)] pub fn main at its current path. Nothing moves, no package is added, and the cli and testing features keep building NVX's own programs without adding documented API.

Today (dev e42b1795) and after:

Groups, in order. Each group issue lists its PRs, with their goals, contents, Needs and estimates.

Notes.

• The snapshot comes first. SL0.4 records today's API without changing it; SL1.5 then updates only the hidden markers for NVX's programs.
• The binaries keep their paths and behavior. Each src/bin/*.rs keeps calling the same entry point. A module that contains only a program becomes hidden; where library code shares the module, only main becomes hidden.
• The features stay. host, guest and serde are library features. cli and testing build the CLI and fake OpenVMM and add only hidden entry points.

Tests. The snapshot walk covers re-exports, hidden modules, feature-gated items and an unknown rustdoc JSON format. CI builds the library for Linux and Windows with every feature but bundled, compares the committed lists and prints the difference. CI also denies warnings in builds of cli alone and of testing alone. Every binary builds and its existing command-line, output and exit-status tests pass unchanged. Rustdoc shows the library parts but none of NVX's program modules or entry points.

Done when: every group issue is closed; CI checks the public API snapshots; every binary keeps working; and the snapshot marks NVX's program entry points hidden without adding, removing or moving an item.