Firecracker: rootfs preparation from CID store OCI images

## Description

`src/sandbox/firecracker.rs` line ~281 has a TODO: "Pull OCI image from CID store, extract layers into rootfs.ext4". The Firecracker driver can configure and start VMs but cannot yet prepare the guest root filesystem from content-addressed workload images.

## Requirements

- Fetch OCI image layers from the CID store by content address
- Extract and overlay OCI layers into a ext4 filesystem image (rootfs.ext4)
- Mount rootfs.ext4 as the Firecracker VM's root drive
- Handle multi-layer OCI images with proper overlay ordering
- Clean up temporary filesystem images on job completion
- Size rootfs appropriately based on extracted content + scratch space

## Success Criteria

- [ ] OCI images fetched from CID store and assembled into rootfs.ext4
- [ ] Firecracker VM boots from assembled rootfs
- [ ] Multi-layer images assembled correctly
- [ ] Cleanup removes temporary rootfs files
- [ ] Integration test: store OCI image → prepare rootfs → boot Firecracker → execute → verify output
- [ ] Test on real Linux+KVM hardware

## Testing (Principle V)

- Build minimal OCI image, store in CID store, boot in Firecracker
- Test with multi-layer image (base + app layers)
- Test cleanup after job completion (no leftover rootfs files)
- Test with corrupted image (must fail gracefully, not leave partial files)