[feat] Add safe growth for existing VM disks

[Fail-Safe]

Summary

Existing VM disks default to 24 GiB, and choosing a larger factory-image capacity does not enlarge an existing installation. Add a source-checkout maintenance command that grows a stopped VM without resetting its data:

macos/resize-vm-disk.sh --size-gib 32          # preview
macos/resize-vm-disk.sh --size-gib 32 --apply  # back up and grow

The command reuses the launcher's workspace lock, metadata checks, and paired-boot validation. It requires APFS, checks host headroom, retains checksum-verified disk and boot backups, and extends only the validated disk inode. It refuses active VMs, shrinking, unsafe paths, and unrecognized storage. Equal-size requests are no-ops. The existing guest boot service expands ext4 on the next launch.

Custom locations use an explicit --state-root; this command does not read the app's location preference or support legacy development workspaces. It needs Python 3 but no app rebuild. The README covers capacity limits, backup retention, and recovery.

Related to #104 and #132. Complements draft #141, which configures capacity for new/reset VMs and explicitly excludes resizing existing disks. This provides a command-line maintenance path that a future UI can build on.

Validation

• Full make test with the Xcode developer directory selected, including 14 new resize tests.
• bash -n and git diff --check.
• Ran the command on an isolated APFS clone of an existing 24 GiB guest: verified backup, growth to 32 GiB, successful boot with the original paired kernel, automatic ext4 growth, and clean shutdown.
• A second resize was rejected while real QEMU held the workspace lock.
• Read-only e2fsck -fn passed after shutdown; filesystem metadata reports 8,388,608 blocks of 4,096 bytes (32 GiB).

No factory-image inputs or native app code changed. The isolated boot used an existing built runtime; this change does not require a new factory build.

[themartiano]

Thanks for the pull request!

Codex comments

Reviewed locking, backup verification, inode checks, and growth-only behavior. Full tests passed, including all 14 resize tests. Existing live APFS validation is documented.