Provide exact and sparse host-file publication primitives

Tracking issue: MicroVM support and private snapshot restore.

Motivation

Publishing a RAM image requires precise file contents and length, including when
zero-filled regions are represented sparsely. Reusable host-file primitives should
make short transfers and incomplete output observable so snapshot code can build a
transaction without duplicating platform-specific I/O behavior.

Proposed Scope

• Add the exact-transfer and sparse-file operations needed for publication to the
  platform abstraction layer (pal).
• Preserve logical contents and exact file length when representing holes or
  zero-filled regions sparsely.
• Define completion and error behavior for short I/O, invalid ranges, and host
  storage failures.
• Document which guarantees concern byte transfer, allocation, flushing, or final
  visibility; callers must not confuse those guarantees.
• Keep these primitives independent of guest-memory layout and snapshot policy.

Acceptance Criteria

• Exact operations complete the requested transfer or return an error that
  does not present partial output as complete.
• Dense and sparse publication paths produce equivalent logical contents and
  the requested length, including zero-length and boundary cases.
• Tests exercise short-transfer and failure paths with explicit cleanup
  responsibility for partially created output.
• Arithmetic and range validation prevents overflow and unintended file access.
• Supported host paths have focused tests, and filesystem-dependent sparse or
  durability guarantees are documented accurately.

Dependencies

No feature prerequisites. The snapshot transaction will use these operations but
owns manifest consistency and publication policy.

Non-Goals

This issue does not define a multi-file snapshot transaction, guest-memory policy,
or a universal durability guarantee across filesystems.

Start by reading the pal platform abstraction layer and the 00-microvm.md tracking document to identify the host-file entry points and supported host paths. Define focused tests for exact transfers, sparse and dense equivalence, range validation, short I/O, cleanup, and failure behavior; done means the documented guarantees and acceptance criteria hold without coupling the primitives to snapshot policy.