[auser]

Summary

Split a fail-closed snapshot-registry race fix from draft #5326 so it can be reviewed independently against current main. This PR enables no warm claim and publishes no runtime or image.

What changed

• Reserve each snapshot ID before backend staging, issue a fresh generation on every sealed publication, reject stale and concurrent callers, and hold a per-ID guard through materialization and removal.
• Quarantine failed stage/cleanup; block claims after failed removal and retain the owner's handle for retry. Retire successfully removed entries before concurrent waiters can enter the backend or touch a new publication under the same ID. Ten focused tests cover these transitions.
• Mark ADR-059 explicitly as a preview design, not a shipped warm read lease. Admit the measured regression coverage under a narrow footprint ratchet.

Validation (head 488ad667996887aa8991d03e055a2955260c9108)

• cargo test --locked -p mvm-runtime --lib trusted_snapshot_service::tests: 10 passed.
• cargo clippy --locked -p mvm-runtime --lib --tests -- -D warnings: passed.
• cargo fmt --all -- --check, git diff --check, target/debug/xtask check-rust-footprint, target/debug/xtask check-claim-catalog, target/debug/xtask check-file-size: passed. Footprint: 966,463 SLOC / 1,231,847 physical; ceilings 966,500 / 1,232,000.
• CI's exact invariant commands cargo run -p xtask -- check-declared-backing --self-test and cargo run -p xtask -- check-declared-backing: passed locally. Previous CI failure on missing ADR declaration fixed; same-head CI pending.
• Full cargo test --locked -p mvm-runtime --lib on the preceding head: 1,364 passed, 7 ignored. Same-head full suite is pending CI. No warm-claim or production-release witness is claimed.

Review focus and boundaries

The existing TrustedSnapshotBackend::materialize still yields a writable destination and is not a VMM-lifetime read lease. No Linux memfd builder, fs-verity provider, warm admission path or VMM descriptor handoff remains in this PR: the standalone memfd API was removed because a duplicated descriptor could outlive its budget reservation. Implement those pieces only with an owned authenticated closure and a VMM/last-child lease, then validate them separately. Until then this PR does not enable warm claims; PR-only runtimes remain cold-only. A failed stage reserves its ID rather than deleting backend state it cannot prove it owns; the eventual production owner must bound reservations before exposing publication to requests.

Draft #5326 remains independent and unmerged. Landing this PR still requires review, green CI, and explicit authorization to merge the specific change.