nvx-rs slimming, phase 2.1: a VM's configuration, checked and lowered without touching the host #1079

Parent: #1076. Phase: 2, the new interface, beside the old one. Needs: #1077. Unblocks: inside phase 2, groups of #1080, #1081, #1082; #1088.

Goal. One VmConfig describes a VM for both a cold boot and a restore, with the cold-only settings in Boot and a capture's own settings in CaptureConfig, and Runtime holds what every launch shares. VmConfig, CaptureConfig and the identities check their own data without reading the host, and the kernel command line and OpenVMM's arguments come from these values alone. The old APIs keep working beside them.

Today (dev e42b1795) and after:

Groups, in order. Each group issue lists its PRs, with their goals, contents, Needs and estimates.

Notes.

• The RAM upper has a cap: UpperConfig::Ram { max_memory_percent }, from 1 to 90, 50 by default. The root's tokens carry it with the overlay mode, the journal policy and the GPT bound, and the guest mounts the tmpfs with size=N%.
• The boot tokens change, but not their version. SL2.4a1 and SL2.4a2 change the boot tokens, and the_boot_contract_version_names_these_tokens takes the new ones; nothing is deployed, so BOOT_CONTRACT_VERSION stays as it is.
• Boot is required without a snapshot, and refused with one. It holds the caller's command line and an optional CaptureConfig; host::vm::create, which sees the snapshot, enforces the pairing, while VmConfig::check checks the value alone.
• The new renderer leaves NVX's own guest tokens to its caller. VmConfig renders only the root's, the view's and the mapping tokens; the CLI renders NVX's own tokens from nvx-rs slimming, phase 3.1: the CLI switches to the new interface #1083, and the old APIs keep theirs until nvx-rs slimming, phase 4.2: the old code is deleted, consumers first #1087 deletes them.
• A capture names its snapshots. CaptureConfig holds DiskCapture::Fresh, the processors' and memory's Capacity, opaque Invariants and BlockGeometry; CaptureConfig::identity(&VmConfig, &Runtime) returns a CaptureIdentity, which a caller can persist and compare.
• The mapping table is public. VmConfig::mapping_table() returns the entries that nvx_maps counts, and protocol::maps becomes a public module; protocol's root keeps its re-exports.
• A temporary entry point. Until host::vm::create calls it, the whole-config renderer is public and documented as temporary; nvx-rs slimming, phase 2.2: a VM's lifecycle: create, spawn, stop, exits and reattach #1080 makes it internal.

Tests. Unit tests of VmConfig's and CaptureConfig's checks, the identities and the checked leaf values, without touching the host. Parity tests of the kernel command line, through test-only conversions, cover the root's and the view's tokens, nvx_maps and mapping_table(), and the refusals of the tokens that nvx renders, and of virtfs_*, in Boot.command_line. The argument renderer's tests cover processors, memory, blockless and layered roots, block devices by path, the network's and the export's arguments, the console's attachment and LaunchOptions, and check that it never renders --microvm-lifecycle or --microvm-workload-identity, which today's launch paths pass. native_egress_rules() turns representative policies into the expected canonical allow and deny lists (destinations merged, exceptions subtracted, port ranges merged), returns at most MAX_RULES per list, and reads nothing on the host.

Done when: every group issue is closed.