Make lifecycle and quiesce operations transactional and fallible

Tracking issue: MicroVM support and private snapshot restore.

Motivation

Snapshot capture requires processors and devices to reach a consistent boundary.
An operation can fail after some participants have stopped or saved state, so the
lifecycle must represent errors and partial progress explicitly. Callers need a
bounded outcome and a known VM state rather than an indefinite wait or a partially
quiesced machine presented as healthy.

Proposed Scope

• Make the relevant state-unit lifecycle operations fallible and update all
  callers to handle the resulting errors.
• Define transaction phases, participant ordering, and the state retained for
  recovery or cleanup.
• Bound quiesce work and waiting, with an explicit result when a participant cannot
  reach the requested boundary.
• Define unwind behavior for failures during stop, save, restore, or resume,
  including failures while unwinding.
• Tear down temporary I/O-boundary preparation and transaction resources on failed
  or cancelled operations; do not leave callbacks or guards active for a retry.
• Preserve the normal lifecycle of machines that do not use snapshots.

Acceptance Criteria

• Failure injection at each transaction phase produces a contextual error and
  a documented final VM state.
• A participant that cannot quiesce produces a bounded failure, not an
  unbounded wait or an assertion on external input.
• Successfully prepared participants are unwound or retained in an explicitly
  safe stopped state when another participant fails.
• Failed and cancelled operations release temporary preparation, and a retry
  does not observe stale hooks or duplicate cleanup.
• All lifecycle callers compile and handle errors without silently discarding
  them; existing start/stop behavior remains covered.
• The transaction and failure-state contracts are documented for device
  implementers.

Dependencies

• B02: End-to-end cold-boot microVM profile.
• F05: Clone support for type-erased protobuf values.

Non-Goals

This issue does not define the persistent snapshot format or implement network
and filesystem reconstruction. Device-specific quiesce work builds on this shared
lifecycle contract.

Start with the linked 00-microvm.md tracking document and map the state-unit lifecycle operations and their callers described in the scope. Trace stop, save, restore, resume, quiesce, and cleanup paths before defining transaction phases and failure states. Done means bounded failures, documented recovery states, clean cancellation and retry behavior, handled caller errors, and lifecycle coverage for non-snapshot machines.