Persistent volumes across VM restarts

Currently all VM state is lost on destroy. For longer sessions, cold caches (pip, npm, cargo, Docker layers) on every new VM could add friction.

Before implementing, validate that this is a real pain point and that it can be done securely:

Open questions:

• How much time do cold caches actually cost in practice? Profiles already pre-install packages into the golden image, and VMs typically live hours/days.
• Can a persistent volume become a vector for state pollution between sessions? A compromised VM could plant artifacts that affect the next session.
• How do we handle volume corruption (unclean shutdown, full disk)?
• Should volumes be per-project, per-image, or global?

Implementation path if justified:

• Firecracker: second block device (/dev/vdb), stored outside the instance directory so destroy preserves it
• Lima: limactl disk create with raw format for VZ compatibility
• Guest: bind-mount subdirs to /var/lib/docker, ~/.cache/pip, ~/.npm, etc.
• destroy preserves volumes by default, --volumes flag to explicitly delete

This should only be built if real users report cache warmup as a significant pain point, and the security model is well-defined.

Start by validating whether cold cache warmup is a significant user pain point, then investigate the Firecracker and Lima volume options described in the issue. Define the security model, isolation scope, corruption handling, and destroy behavior; the work is justified only if user evidence supports it and these questions have clear answers.