Refresh nspawn device config before machine startup

[Copilot]

Host device paths can change across host reboots, leaving the persisted nspawn config with stale bind mounts. This adds a systemd-managed refresh step so device mappings are rediscovered before an existing nspawn machine starts.

• Startup hook

  • Writes unbounded-agent-nspawn-config@<machine>.service
  • Orders systemd-nspawn@<machine>.service after the refresh unit

• Config regeneration

  • Adds hidden agent command:

    unbounded-agent regenerate-nspawn-config kube1

  • Loads the persisted applied config for the machine
  • Resolves fresh host device/GPU state
  • Rewrites the .nspawn config and service drop-in

• Lifecycle cleanup

  • Removes the generated refresh unit during nspawn reset cleanup

• Docs and tests

  • Updates nspawn reference docs for the refresh behavior
  • Extends render tests and snapshots for the new systemd dependency

[bcho]

@copilot can we rename the oneshot target to regenerate config so we can further extend it to include other config regeneration in the future

[Copilot]

@copilot can we rename the oneshot target to regenerate config so we can further extend it to include other config regeneration in the future

Addressed in 71158be: the oneshot unit is now unbounded-agent-regenerate-config@<machine>.service and it runs the generalized hidden regenerate-config command.

[bcho]

@copilot resolve conflicts

[Copilot]

@copilot resolve conflicts

Resolved the conflicts by merging origin/main into the PR branch and preserving the regenerate-config behavior in merge commit 7edafe8.