nvx-rs: exports, MAPS and network templates for clones #846

Parent: #834 (#833), step 4. Needs: #845, and #822's PRs 8 and 11 (mapping tables and network policy in the test adapter's VMs). Unblocks: #847.

Goal. Zero or one export per clone, bound on the template's dormant filesystem slot at restore, with MAPS after Ready: one directory, under stage 1's rule, which #857 lifts. Network templates, under stage 1's rule.

Today (dev d04d9fb):

• filesystem::plan builds an ExportPlan, an aggregate export of host directories and files with the guest's bind mounts, which renders OpenVMM's arguments (nvx-rs/src/host/filesystem.rs:152-188, :404-443, :1737). OpenVMM's dormant slot accepts one --mount directory at restore (openvmm/openvmm_entry/src/microvm/filesystem.rs:983-995).
• ControlSession::map_host_paths sends MAPS and checks the acknowledgments (nvx-rs/src/host/session.rs:159-223).
• network::openvmm_arguments lowers a NetworkPolicy. It attaches no NIC for deny-all egress with ingress and host loopback denied and no proxy (network/mod.rs:632-665).

Stacked PRs. PR 2 builds on PR 1; each lands with its own tests.

PR 1 of 2: one directory export, and MAPS. Needs #844's PR 4, #845's PR 3, and #822's PR 8.

• ClonePlan takes zero or one export, planned with filesystem::plan. Under stage 1's rule, the plan must have exactly one child, a directory. The restore passes it as the dormant slot's one --mount, with the child's hidden, re-exposed and writable paths and the owner mode, and the binds' sources drop the child index, because the directory is the export's root. A plan with several children, or a file child, is refused before launch; nvx-rs: aggregate exports for clones #857 lifts the rule.
• ExportPlan::verify checks the plan before each restore, as before each cold start.
• The record carries the export plan's identity and the mapping count, from 1 to 4,096. A clone without mappings has no export, and its slot stays dormant.
• MAPS goes after Ready, in order. Start follows once every mapping has succeeded. A partial or failed MAPS tears down the clone.
• Tests: with a fake transport, partial and failed MAPS, and mappings without an export, refused; an export plan with two children, or a file child, refused before launch; a mapped object that changed since planning, refused before launch. In MicroVM CI on KVM, MSHV and WHP: clones with and without an export.

PR 2 of 2: network templates. Needs PR 1, and #822's PR 11.

• A template without a NIC serves clones without network.
• Otherwise, one template per network policy, with the policy's identity in the key, and the restore passes the template's policy unchanged.
• Clones get DNS and the proxy endpoint through the record, and no ingress, host loopback or forwards until nvx-rs: per-clone network policies on deny-all templates #850.
• Tests, in MicroVM CI on KVM, MSHV and WHP: captures without a NIC, and with one per tested policy; DNS and the proxy in clones.

Not in scope: aggregate exports (#857, with #540); per-clone policies (#850).

Guide (#591's numbering): 2.1.4 (the export at restore), 3.5.6 (one template per policy until #850), 3.6.2, 3.6.9 and 3.6.10 (one directory on the dormant slot until #857, and MAPS after Ready).

Done when: both PRs are merged, and their scenarios pass in CI on the three backends.