Add debugfs fault-injection controls for local-libvirt Systems

## What to build

Add MCP tools for configuring supported in-guest debugfs fault-injection knobs on ready local-libvirt Systems. The first slice should support a small explicit allowlist such as failslab and fail_page_alloc, with readback, enable, disable, and cleanup behavior.

## Acceptance criteria

- [ ] A contributor can inspect supported fault-injection knobs and their current state for a ready System.
- [ ] A contributor can set bounded fault-injection parameters for an allowlisted knob.
- [ ] A contributor can disable or reset a configured knob.
- [ ] Missing debugfs/fault-injection kernel support returns configuration_error with remediation.
- [ ] Tests cover supported knob configuration, invalid knob rejection, reset behavior, missing support, and RBAC denial.

## Blocked by

None - can start immediately.

Start by locating the MCP tool entry points for ready local-libvirt Systems and the existing RBAC and configuration-error handling. Trace how in-guest debugfs access is checked, then cover the explicit failslab and fail_page_alloc allowlist with readback, bounded settings, disable/reset behavior, missing-support remediation, and the listed tests.

Written by the indexing model from the issue text.