nvx-rs slimming, phase 2.2: a VM's lifecycle: create, spawn, stop, exits and reattach #1080

Parent: #1076. Phase: 2, the new interface, beside the old one. Needs: #1077; inside phase 2, groups of #1079 (see the table below). Unblocks: inside phase 2, groups of #1081; #1083, #1086.

Goal. A caller creates a VM in a private directory with fixed, documented names; inspects it, or hands it to its own launcher; spawns it with no child left behind on failure; stops it only with a confirmed exit; proves an exit after its own restart; and verifies and reattaches a running VM from values that it saved.

Today (dev e42b1795) and after:

Groups, in order. Each group issue lists its PRs, with their goals, contents, Needs and estimates.

Notes.

• The Windows spawn lock is private to host::vm::spawn. A Windows caller must not start other processes while a VM starts, for example by holding its own lock around host::vm::spawn and its other spawns.
• No half-made VMs. A failed create removes what it made; if spawn fails, no child is left running; if it succeeds, the caller owns a VM that outlives it.
• Persist what recovery needs before the spawn. nvx never writes the Capability. A caller that recovers or reattaches journals Prepared::capability() and Prepared::outputs() before the spawn, then records the process reference once the spawn succeeds.
• In-place changes update their callers. Process::wait and report::read change their signatures in place; a crate-private wait keeps the old wrappers stable until their callers go in phase 4.
• Restores come later. create refuses from: Some until nvx-rs slimming, phase 2.3: one snapshot type, activation record v2, and restores that the caller drives #1081.

Tests. Unit tests of the directory's checks, reserved names and private creation, on both platforms; Capability::as_bytes, its redacted Debug, and no capability file written. A failed create removes everything that it made, and a failed spawn leaves no child. A cold create(from: None) refuses a missing Boot; Prepared::into_command hands over the opened log and the inherited handles without reopening them. stop returns Stopped only after a confirmed exit, and fails with StillRunning when it can't confirm one; an unreadable or malformed outcome report is an Io error in Stopped::report, and a missing one is Ok(None). Process::wait returns None at its deadline, and an Exited proof after the exit; Process::open returns Exited when the recorded process is gone, its ID now belongs to a process with another start time, or the boot has changed; exit_handle gives a duplicated handle, or none on a host that only polls. connect_verified refuses an endpoint that another process serves, and verify and reattach refuse another runtime with RuntimeMismatch, and verify connects to nothing. protocol::restore_ready accepts the exact event and refuses malformed input; ReadyListener::into_std hands the listener over; and, on Linux and Windows, the listener refuses a client that isn't the VM's process. A compiled example launches a cold VM through an external launcher.

Done when: every group issue is closed.