fix(microvm): repair real-host boot and lifecycle cleanup

[jiashuoz]

Real Firecracker execution exposed two boot blockers: the cgroup-v2 jailer joined the delegated parent instead of creating a per-VM child, and guest net.FileConn rejected AF_VSOCK after the kernel connection succeeded.

Request child creation with the kernel-default CPU weight, and use a poller-backed socket adapter for vsock with context cancellation and deadlines. Reclaim cgroups on failed creates and orphaned resumes. Hold the old rootfs inode during the KVM resume assertion so legitimate XFS inode recycling cannot cause a false failure. Update host and transport documentation.

Validation:

• GitHub CI verify passes on the final head.
• Argument and cleanup regressions failed before their fixes and pass afterward; the original vsock failure was reproduced on real hardware.
• Five real KVM lifecycle samples and all 12 Firecracker-backed contract subtests passed with a compatible guest binary. The final reviewed binaries also passed the hardware smoke and all 12 contract subtests.
• Linux socket I/O, EOF, deadline and cancellation regressions pass; the full Linux guest package passes on the final binary. The sparse-copy regression also passes on Linux.
• Build, vet (including Linux), protocol checks and image policy checks pass. The remaining Go suite passes serialized with two explicit environment exclusions: a macOS sparse-copy assertion that also fails on unchanged main, and Docker Hub connectivity. A load-sensitive latency test passes serialized.
• Independent and adversarial reviews are clear after fixing rollback, orphan cleanup and early cancellation findings.

This does not qualify the published guest image or establish complete serverless readiness. No deployment or merge is included.