Implement transactional snapshot capture and private restore

Tracking issue: MicroVM support and private snapshot restore.

Motivation

Reusing a prepared microVM requires a snapshot that is either complete and
restorable or clearly unpublished. The manifest, immutable RAM image, and VM state
must describe the same boundary, and each restored instance must have private
memory. Defining a format without a working transaction would leave these central
correctness properties untested.

Proposed Scope

• Define a versioned, bounded manifest with explicit state compatibility, memory
  layout, and file-reference validation.
• Capture the base profile at a defined post-OUT boundary, accounting for
  completion of the intercepted guest I/O and the corresponding VP state.
• Publish immutable RAM and its manifest transactionally using the host-file
  primitives; incomplete staging output must not appear to be a valid snapshot.
• Restore the base profile using private copy-on-write guest memory and the saved
  CPU/clock contract.
• Integrate bounded Linux descriptor-table preparation where appropriate without
  hiding failures or changing snapshot semantics.
• Clean up staging files, mappings, and temporary I/O-boundary preparation after
  failed or cancelled capture/restore operations.
• Keep manifest, publication, and a working base capture/restore path in one PR.

Acceptance Criteria

• A source-built guest captures at the post-OUT boundary and resumes with the
  documented instruction and I/O completion semantics, without duplicate effects.
• Multiple private restores begin with the captured RAM and diverge on writes
  without modifying the snapshot or one another.
• Oversized or malformed manifests, invalid memory ranges, missing or truncated
  RAM files, and incompatible state are rejected without panics.
• Failure injection during capture, publication, and restore leaves no
  apparently complete artifact that refers to incomplete state.
• Failure at the guest I/O boundary tears down temporary hooks and resources;
  retry and VM teardown do not hang or retain stale preparation.
• Applicable KVM and WHP VMM tests cover the combined base transaction through
  cargo xflowey vmm-tests-run.
• Format limits, publication guarantees, supported filesystems, compatibility,
  and failure outcomes are documented.

Dependencies

• S02: CPU and clock snapshot contracts.
• F10: Private mappings and memory-backing integration.
• F11: Exact and sparse file-publication primitives.
• F12: Bounded Linux descriptor-table pre-expansion.

Non-Goals

This issue establishes the base-profile transaction. General virtio persistence,
live network/filesystem attachment reconstruction, snapshot tiers, and performance
optimizations are separate work; unsupported devices must be rejected explicitly.

Start with 00-microvm.md and the dependent issues S02, F10, F11, and F12 to understand the snapshot contracts and required primitives. Run the applicable VMM coverage with cargo xflowey vmm-tests-run, then trace the existing capture and restore entry points. Done means transactional publication and private restores work across supported KVM and WHP paths, failures clean up safely, malformed state is rejected, and the format guarantees are documented.