Add Firecracker UFFD snapshot pager

[sjmiller609]

Summary

• add config-gated Firecracker UFFD snapshot restore with mandatory UFFD when enabled
• add versioned per-host pager subprocess, Unix control API, session sockets, bounded shared page cache, health/stats/drain
• add mailbox overlay pages for UFFD restores so snapshot memory stays immutable
• wire UFFD session/cache metadata through restore, standby, fork, stop, delete, and state health checks

Tests

• go test ./lib/uffdpager ./lib/hypervisor/firecracker ./cmd/api/config ./lib/providers
• go test ./lib/instances -run 'Test(BuildGuestResumeNetworkMailboxOverlayDoesNotMutateMemory|PatchGuestResumeNetworkMailbox|GuestNetworkReconfigureConfig|RequiresRestoreConfigDiskRefresh)'
• GOOS=linux GOARCH=amd64 go test -c -o /tmp/hypeman-uffdpager.test ./lib/uffdpager
• GOOS=linux GOARCH=amd64 go test -c -o /tmp/hypeman-firecracker.test ./lib/hypervisor/firecracker

Note: full ./lib/instances hit unrelated VZ/kernel-header download failures on this macOS host.

[sjmiller609]

Closing in favor of #262, which recreates the UFFD pager work on the new #261 base and folds in #259. Keeping the old branch around for comparison.