Persist network devices and reconstruct validated attachments

Tracking issue: MicroVM support and private snapshot restore.

Motivation

A restored network device must reconcile guest queue state with a newly prepared
host attachment. Process-local sockets and backend handles are not portable
snapshot state, and rebuilding an attachment must not silently change its guest
identity, egress policy, or resource limits.

Proposed Scope

• Persist validated guest-visible virtio-net state and queues through the generic
  virtio contract.
• Define a portable attachment description and reconstruct the host backend during
  restore.
• Revalidate the canonical bound IPv4 egress policy, exact network identities, and
  Consomme flow-admission limits before activation.
• Establish shared attachment preparation and cleanup that later device backends
  can use within the same lifecycle transaction.
• Define the treatment of packets and host connections in flight at capture,
  including cases requiring guest reconnection.
• Delay activation until preparation succeeds and unwind partial attachment work
  on failure.

Acceptance Criteria

• Queue and device state round trips remain coherent with guest memory, and
  malformed queue state is rejected before activation.
• Restored attachments use the intended identity, policy, and limits;
  incompatible or unauthorized substitutions are rejected.
• A VMM test captures and restores during active transmit/receive I/O and
  verifies renewed guest connectivity and the documented packet-boundary behavior.
• Tests distinguish guest queue persistence from host-connection continuity;
  no unsupported promise of preserving live TCP sessions is implied.
• Failed backend preparation releases host resources and leaves no partially
  active device or stale policy binding.
• Network restore works without filesystem support.

Dependencies

• D01: Generic virtio persistence and activation.
• F07: Canonical bound IPv4 egress policy.
• F09: Bounded Consomme flow admission.

Non-Goals

This issue does not serialize live host sockets, add general network migration, or
require filesystem attachment reconstruction.

Start with 00-microvm.md and the linked dependencies D01, F07, and F09 to understand the required persistence, policy, and flow-admission contracts. Then trace the existing VMM network restore and generic virtio entry points; done requires the listed active-I/O, validation, cleanup, queue-persistence, and filesystem-independent restore tests to pass.