Provisioner.Provision never assigns a MicroVM id, so CreateMicroVM always fails against real flintlockd

Nobody has claimed this yet.

`Provisioner.Provision` (`internal/reconciler/provision.go`) clones the pool's `MicrovmTemplate`, sets `AllowGuestAgent`, and calls `CreateMicroVM`. It never sets `spec.Id`. flintlockd rejects the request:

```
rpc error: code = Unknown desc = converting request: creating vmid from spec: name is required
```

Every VM battery tries to provision fails this way. Confirmed against real flintlockd v0.12.1 on real hosts, and independently by `liquidmetal-dev/acceptance-tests`, which found the same thing reading the same code (`docs/battery-known-gaps.md`, "PoolSpec.microvm_template is applied verbatim to every VM in the pool"). Their workaround is to put a static id in the template and cap pool size at 1 — a caller can set an id itself, but can't make it unique across replicas from outside the reconciler.

This doesn't show up in battery's own e2e suite because the fake flintlock double in `internal/reconciler/fake_flintlock_test.go` doesn't check the id at all. It fabricates a uid and returns success regardless of what `CreateMicroVM` was sent. Real flintlockd does check.

The caller I hit this from (flintlock-runner) leaves `Id` empty on purpose: the template is shared by every VM in a pool, so no single id can be right for all of them. `reconciler.go`'s own comment still describes the intended contract: "the Pool Manager names every MicroVM it creates from this template." Nothing in `Provision` currently does that.

**Suggested fix:** generate a unique name (and set the namespace) before calling `CreateMicroVM` — e.g. `-`. Might also be worth having the fake in `fake_flintlock_test.go` reject an empty id, so a regression here fails a test instead of passing silently.

Happy to send a PR if useful — filing first since I'm not sure which naming scheme you'd want (uuid, pool-name prefix plus counter, something else).

Read internal/reconciler/provision.go and the naming contract noted in reconciler.go, then inspect how CreateMicroVM is called. Use internal/reconciler/fake_flintlock_test.go as the regression-test entry point; done means provisioning supplies a unique non-empty id and namespace, while the fake rejects an empty id so the test cannot pass silently.

Written by the indexing model from the issue text.