OpenVMM prerequisite: omit dormant virtio-fs on direct no-map cold boots #547

Parent: #535. Parallel OpenVMM prerequisite for the zero-export direct-image cold profile; required before #541 acceptance. Implement and review in nanvix/openvmm; NVX pins the reviewed revision and proves the real guest/device outcome. This is independent of #540, which attaches an aggregate to a dormant slot on platform restore.

Why

At the current public VMM revision, a cold microVM defaults to filesystem_slot=true even without --mount and instantiates a dormant fs:microvm0 device. Omitting a mount argument or skipping a guest mount therefore does not satisfy #535/#541's requirement that a single-image, zero-map/no-network direct cold launch avoid an unnecessary virtio-fs device. The default is intentional for existing profiles; change it only for the new opt-in topology.

Contract

• Define a versioned opt-in cold launch topology with no fs:microvm0 device, virtio-fs transport, tag or discovery token when the caller has no exports and will not capture a reusable platform template. A mapped cold launch still attaches its aggregate; a template capture still declares the dormant slot so microvm: at a platform restore, attach an aggregate export to the dormant filesystem slot #540 may populate it on restore. Direct-image/no-map cold launches remain slot-free and NIC-free as specified in nvx-rs: provide a standalone image-backed sandbox cold-start path #541. No runtime hotplug.
• Reject the opt-out when any --mount, aggregate child, host mapping, platform capture or restore requires the filesystem slot; do not silently drop an export or weaken old snapshot exact-match rules. Preserve previous cold defaults and any older workload snapshot topology unless the new profile explicitly opts in.
• NVX's typed host plan selects this mode only for a validated zero-export cold profile. The guest's observed device inventory, not absence of CLI options alone, is the acceptance boundary. A future request for mappings needs a new compatible launch/template; it cannot add the device to a running VM.

Acceptance

• VMM tests compare legacy/default no-export cold, opt-in no-slot cold, mapped cold and dormant-slot template capture. The opt-in inventory has no filesystem device/tag/MMIO/IRQ or guest discovery token; incompatible exports and capture fail explicitly.
• Source-bound NVX tests on supported hypervisors prove one direct-image/no-map/no-network workload reaches Ready with no virtio-fs device in both VMM and guest inventories. A mapped cold launch and a reusable template retain the fixed filesystem slot; no ignored stage counts as a pass.
• Compare source-matched cold-to-Ready p50/p95, device count, and guest memory with an otherwise identical baseline; record a regression budget before accepting the fast path. No added hash, capability probe or empty-slot work appears on the ordinary no-map cold path.
• Publish the reviewed VMM revision and exact NVX pin independently of the four-image-slot prior-art PRs guest: add Ubuntu userland support #116/Adopt bind-once microVM image slots #406 and of dormant-to-aggregate restore issue microvm: at a platform restore, attach an aggregate export to the dormant filesystem slot #540.