nvx-rs: activate a clone's root for GPT images and either upper, with its export, network settings and workload view #845

Parent: #834 (#833), step 4. Needs: #844; and, from the NVX library wiring workstream (#816), #822's PR 5 (the export mount) and #860's PR 1 (the resolver bind, and removable runtime binds). Unblocks: #846.

Goal. Complete root activation in the guest: GPT images, the fresh-scratch check, the hostname and the machine ID, the export, DNS and the proxy endpoint. Together with #843, a clone then activates every image format over either upper.

Today (dev d04d9fb):

• nvx::guest::root::assemble:
  • drops each device's cached blocks with BLKFLSBUF (nvx-rs/src/guest/root/block.rs:111-117);
  • validates a GPT image through guest::gpt::read_disk (nvx-rs/src/guest/gpt.rs:40, root.rs:851-891);
  • resolves the partition devices by name (root/block.rs:147-185). In a clone, those devices were created when the template's kernel found the placeholder.
• A scratch keeps its upper and work directories across boots: assembly creates them unless they exist (nvx-rs/src/guest/root.rs:784-789, :1192-1213).
• Entry::hostname sets each execution's hostname in its private UTS namespace. MachineId::Image keeps the image's /etc/machine-id; MachineId::generate writes a random ID to a new file once per boot, and MachineId::Generated binds that file (nvx-rs/src/guest/entry.rs:40-60, :417-462, :543-590). Entry::bind_runtime makes that bind in the caller's mount namespace, and Root::teardown detaches no busy mount. NVX's managed agent binds in a mount namespace of its own, which ends before the teardown; the test adapter's worker spawns its executions itself, so it must remove the bind before the teardown (nvx-rs: give a layered root's workloads the DNS server that their network policy allows #860).
• The shell init writes virtnet_dns= servers to the initramfs's /etc/resolv.conf (guest/common/init:235-244). No resolver reaches a layered root (nvx-rs: give a layered root's workloads the DNS server that their network policy allows #860). NetworkProxy::url is the proxy as the guest sees it, and how workloads learn it is the caller's choice (nvx-rs/src/host/network/mod.rs:21-26).

Stacked PRs. Each PR builds on the one before it, and lands with its own tests. Their VM tests restore clones through #844's PR 5.

PR 1 of 3: GPT images and the fresh-scratch check.

• Before assembly, a GPT clone asks the kernel to reread the partition table, with BLKRRPART (a new wrapper beside BLKFLSBUF in nvx-rs/src/guest/sys/ioctl.rs). The kernel then has parsed the same read-only bytes that nvx::gpt validates, as at a cold boot, and assembly's existing checks run unchanged.
• A clone-only assembly option makes assembly refuse a scratch whose upper or work directory exists and isn't empty. The check is bounded, and reads no file content. Cold sandboxes keep their upper across boots.
• Tests: without a VM, the reread before assembly. In VMs, on KVM, MSHV and WHP: EROFS and GPT, over tmpfs and over scratch, from one template, with GPT layouts that differ between clones and from the placeholder's; a scratch whose upper isn't empty, refused.

PR 2 of 3: the workload view. Needs PR 1, and #860's PR 1.

• The hostname, for every execution, through Entry::hostname.
• The machine-ID mode: MachineId::Image, or one call to MachineId::generate after Activate is validated, and so after the reseed. Retries and later executions reuse its file. The runtime's binds are removed before the root's teardown (nvx-rs: give a layered root's workloads the DNS server that their network policy allows #860's PR 1).
• Root-activation failures get their documented statuses (nvx-rs: repair a restored clone in the guest, with an owned seed and one acknowledgment #842's PR 3).
• Tests: without a VM, no ID generation before the gate. In VMs: concurrent clones, with isolated uppers and distinct generated IDs; the image-owned machine ID; each failure status.

PR 3 of 3: the export and network settings. Needs PR 2, and #822's PR 5.

• When the record has an export, the guest mounts the filesystem tag with Root::mount_export (runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP #822's PR 5), at an agent-only root. MAPS binds paths inside it after Ready (nvx-rs: exports, MAPS and network templates for clones #846).
• With the record's DNS address, the guest writes a resolver file that names it, and Entry::resolver binds it over the root's /etc/resolv.conf (nvx-rs: give a layered root's workloads the DNS server that their network policy allows #860's PR 1). The proxy endpoint goes back to the adapter, which tells its workloads as it does for cold boots.
• Listener publication stays off until nvx-rs: per-clone network policies on deny-all templates #850, so Entry::check's publication rule doesn't apply yet.
• Tests: without a VM, the export mount and the resolver configuration, with fakes. The VM scenarios run with nvx-rs: exports, MAPS and network templates for clones #846.

Not in scope: listener publication and its capability check (#850); the host's export and MAPS (#846).

Guide (#591's numbering): 3.4.1 (the partition-table reread), 3.5.5 (DNS), 4.1.1 and 4.1.4 (the fresh-scratch check), 4.3.1 and 4.3.2 (the hostname and machine ID).

Done when: the three PRs are merged, and every format and upper activates in VMs on the three backends.