nvx-rs: per-clone network policies on deny-all templates #850

Parent: #836 (#833). Needs: stage 1 (#834), and #536 in NVX's OpenVMM pin. Removes: one template per network policy, and the refusal of ingress, host loopback and forwards.

Goal. One deny-all NIC template serves every network policy that OpenVMM admits, including ingress, host loopback and forwards, with listener publication in the guest. The first release with clones needs all three, as cold boots serve them.

Today, after stage 1: a NIC template carries the policy that its clones use, and its identity is in the key. Clones get no ingress, host loopback or forwards, and listener publication stays off.

• network::openvmm_arguments attaches no NIC for deny-all egress with ingress and host loopback denied and no proxy (nvx-rs/src/host/network/mod.rs:632-665). It renders plain --network-egress deny (:668-683), which isn't a complete deny-all when host loopback is left to OpenVMM.
• The guest's listener announcer is nvx::guest::ingress (nvx-rs/src/guest/ingress/mod.rs). Capabilities::PUBLISHED_REFUSED and Entry::check refuse NET_BIND_SERVICE and NET_RAW when listener publication is enabled (nvx-rs/src/guest/entry.rs:275-280, :622-662).

Implementation:

1. Host:
   • A NIC template gets its own lowering, which captures a complete deny-all.
   • Each restore passes the clone's own policy, through OpenVMM prerequisite: fixed NIC with pre-vCPU mutable policy on platform restore #536's restore option, and the policy leaves the key.
   • Ingress, host loopback and forwards become admissible, within OpenVMM's checks.
2. Guest: listener publication. The guest starts the listener announcer before Ready, and supervises it. An announcer that fails is a root-activation failure. The record's workload identity holds no capabilities; an execution that names its own identity is checked by Entry::check, which refuses NET_BIND_SERVICE and NET_RAW while listeners are published.
3. Record: the publication mode, already in the record (nvx-rs: a canonical activation record for platform clones #838), may now enable publication.

Tests, in the test adapter's CI hook on KVM, MSHV and WHP:

• one deny-all template restored with each policy element: egress rules, a proxy, ingress, host loopback and forwards;
• a busy forward port fails the restore, as a host fault;
• an execution whose identity holds a capability that publication refuses fails to launch.

Guide (#591's numbering): 2.1.4 (the policy at restore), 3.5.4 (ingress and host loopback for clones), 3.5.6 (deny-all templates), 5.5.9 (listener publication). The interim rule leaves the guide.

Done when: merged, with the interim rule's tests replaced by these.