Bound Linux descriptor-table pre-expansion

Tracking issue: MicroVM support and private snapshot restore.

Motivation

Preparing host resources can move descriptor-table growth out of a latency-sensitive
startup or restore path. That preparation must itself be bounded: a large process
limit should not cause disproportionate allocation, startup work, or temporary
descriptor use.

Proposed Scope

• Provide a bounded Linux descriptor-table pre-expansion primitive in pal.
• Relate the requested expansion to anticipated demand and applicable process
  limits, with checked arithmetic and explicit limits on work.
• Handle resource exhaustion and unsupported conditions without leaking temporary
  descriptors or changing unrelated process policy.
• Document whether a caller should treat an unsuccessful pre-expansion as an
  optimization miss or an operation failure.
• Keep the primitive independent of snapshot format and machine configuration.

Acceptance Criteria

• Tests cover zero, ordinary, excessive, and limit-constrained requests.
• Expansion effort stays within the documented bound even when the process
  descriptor limit is unusually high.
• Temporary descriptors are released on both success and failure.
• Resource exhaustion produces the documented result without a panic or an
  unintended change to process limits.
• Non-Linux builds remain unaffected, and the caller-visible contract is
  documented.

Dependencies

No feature prerequisites. Snapshot restore can consume this startup-latency
primitive separately.

Non-Goals

This issue does not raise system-wide limits, guarantee a particular restore
latency, or require eager allocation of all resources a VM might eventually use.

Start with 00-microvm.md and the pal area, then identify the existing Linux resource-preparation entry points. Define the caller-visible result for success, resource exhaustion, and unsupported systems before implementing the bounded primitive. Add coverage for zero, ordinary, excessive, and limit-constrained requests, including descriptor cleanup and unaffected non-Linux builds.