nvx-rs slimming, phase 3.2: snapshots through NVXC and the CLI #1084

Parent: #1076. Phase: 3, NVX's own binaries on the new interface. Needs: #1081; inside phase 3, groups of #1083, #1085 (see the table below). Unblocks: inside phase 3, groups of #1083, #1085; #1086, #1090. The lanes of phase 3 meet at group level, never in a cycle: each group issue names the groups that it needs.

Goal. NVX's host can ask nvx-init for a capture and activate a restore over NVXC; a crate-private, cli-gated driver beside host::session drives a restore for blocking callers; and the CLI keeps named snapshots (#853), captures them, and restores sandboxes and one-off VMs from them (#837).

Today (dev e42b1795) and after:

Groups, in order. Each group issue lists its PRs, with their goals, contents, Needs and estimates.

Notes.

• The new messages land in protocol::app as crate-private code, with expect(dead_code) until nvx-init and the restore driver call them. nvx-rs slimming, phase 4.3: the code that only NVX's programs use, and the error codes, become private #1088 later makes the rest of NVXC private.
• An interrupted capture isn't resumed. The capture VM is journaled like a sandbox's launch, so the next command's recovery ends its VM and removes its directory, and the user captures again. Once the capture VM exits, snapshot::finish_capture checks the capture and writes key.bin and snapshot.json beside openvmm/ in the capture VM's directory; the CLI then moves only those three entries into the named snapshot's private directory, keeps them immutable, and removes the capture VM's directory.
• A restore whose command dies can't complete. OpenVMM checks the snapshot's files before it connects the restore-ready endpoint, once and without retry, so the CLI keeps no durable record of its restores; the next command's recovery ends the VM like an interrupted launch.
• A named snapshot is captured before a layered root exists. The Fresh capture VM's command line holds nvx_sandbox=1 and no root's tokens, so the shell /init hands it to nvx-init's capture entry, which assembles no root and waits for NVXC's capture request.
• A raw OpenVMM snapshot is refused by run --restore-snapshot, until snapshots of blockless VMs exist.

Tests. Round trips of the capture request and the activate message, and ControlSession::capture. The restore driver: its 60 s and 30 s budgets and its limit of 3 sessions; cancellation and the VM's exit during each I/O; a new session after one is lost; the refusal of a restore-ready client or a control server that isn't the VM's process; and distinct machine, MAPS and Start failures. The CLI: snapshot names, and a restored sandbox's record that names its snapshot; a capture that leaves exactly key.bin, snapshot.json and openvmm/ in its private, immutable snapshot directory and removes the capture VM's directory; an interrupted capture, whose VM the next command's recovery ends and removes; and a capture whose wait's deadline passes, which is stopped and never finished. Restores cover each image format and upper. Concurrent restores of one snapshot wait for each other's lock, and deprovision of a restored sandbox holds its snapshot's lock while it removes the view; a restore whose command dies is ended by the next command's recovery. run --restore-snapshot restores a strict snapshot and refuses a raw OpenVMM snapshot. Captures and restores on real VMs come in #1086.

Done when: every group issue is closed.