nvx-rs: template mode, repair and activation in NVX's init #852

Parent: #837 (#833). Needs: #851, stage 3 (#836) or #837's fallback, and #817, in the NVX library wiring workstream (#816); its VM tests run with #853. Unblocks: #853.

Goal. NVX's Rust init captures templates and activates clones through the shared guest library, with every stage 3 feature, and NVX's exit statuses and shutdown.

Today (dev d04d9fb):

• NVX's layered root runs under the shell init: guest/common/nvx-init-agent assembles an EROFS layer over an ext4 scratch, rejects GPT and the RAM upper, and starts the managed agent on the control TTY (:89-116, :589-679). nvx-rs: run NVX's layered sandbox root from a Rust PID 1 on the guest library #817 replaces it with a Rust PID 1 on nvx::guest::root and nvx::guest::entry.
• The shell nvx-snapshot captures and repairs (guest/common/nvx-snapshot).

Implementation:

1. Template mode, in nvx-rs: run NVX's layered sandbox root from a Rust PID 1 on the guest library #817's init: it reads /proc/cmdline early. With nvx_snapshot_tier=platform, it accepts only the platform allowlist's tokens, skips root assembly, attaches the control session, and runs nvx-rs: capture preparation in the guest, and template mode in the test adapter's guest #840's preparation and capture.
2. In a clone:
   1. repair (nvx-rs: repair a restored clone in the guest, with an owned seed and one acknowledgment #842), with the CPU prefix (nvx-rs: per-clone CPU targets #849);
   2. the restricted state and Activate over NVXC v2 (nvx-rs: Activate, and the restore transaction in Ready, in NVXC v2 #851, nvx-rs: the restricted control state and Activate after a restore, in the guest library and the test adapter's framing #843);
   3. root activation (nvx-rs: activate a clone's root for GPT images and either upper, with its export, network settings and workload view #845), with listener publication (nvx-rs: per-clone network policies on deny-all templates #850);
   4. then the managed agent serves MAPS, EXEC and Stop as after a cold boot.
3. Statuses: the init maps repair and activation failures to the documented statuses, writes a bounded diagnostic, and powers off. 193, 194 and 195 keep their meanings.
4. Shell tools: nvx-snapshot keeps serving the other snapshot tiers.
5. Sizes: the guest binaries' and initramfs's sizes, before and after, are recorded.

Tests:

• Without a VM: template-mode token handling; status mapping.
• In VMs, on KVM, MSHV and WHP, with nvx-rs: template and clone commands in nvx-rs sandbox #853: template captures; clones of each format and upper; CPU and memory targets; per-clone network policies with listener publication; each failure status.

Guide (#591's numbering): 4.1.4 (NVX's managed layered root in template mode), 5.3.2 (guest preparation in NVX's init), 5.6.2 (NVX's statuses).

Done when: merged, and NVX's clones activate in VMs on the three backends.