nvx-rs: per-clone CPU targets #849

Parent: #836 (#833). Needs: stage 1 (#834), and #801 (#796) in NVX's OpenVMM pin. Removes: one template per CPU count.

Goal. One template serves every supported CPU count from its boot-online count B up to its capacity C.

Today, after stage 1: templates boot with all C CPUs online (B = C), and clones get no CPU target. OpenVMM can bring a CPU prefix online at restore (maxcpus=B at capture, then --restore-processors N), but its platform allowlist refuses maxcpus= until #801.

Implementation:

1. Host: the host library captures with maxcpus=B, where the adapter picks B, the smallest count that the template's clones use: 1 if one template serves every count. It renders --restore-processors N for B <= N <= C, each in {1, 2, 4, 8}. create and refresh select B and C, and both stay in the key.
2. Guest: repair brings the requested CPU prefix online through sysfs, as nvx-snapshot does today, and verifies it before acknowledging. RestoreFinish::new_cpus reports the new CPUs (nvx-rs/src/guest/time/api.rs:787-815). Activate's expected resources include the count, which nvx-rs: the restricted control state and Activate after a restore, in the guest library and the test adapter's framing #843 checks.
3. Authentication timer: no NVX change. The host keeps connecting after the restore-ready event.

Tests, in the test adapter's CI hook on KVM, MSHV and WHP:

• one template restored at each supported count from B to C;
• unsupported and out-of-range counts, refused before launch.

Guide (#591's numbering): 2.1.1 (the maxcpus= token), 5.5.3 (processor activation), 5.5.7 (repair onlines the CPU prefix). The interim rule leaves the guide.

Done when: merged, with the interim rule's tests replaced by these.