nvx-rs: Activate, and the restore transaction in Ready, in NVXC v2 #851

Parent: #837 (#833). Needs: stage 1 (#834), and #821, in the NVX library wiring workstream (#816). Unblocks: #852.

Goal. NVXC v2 carries a clone's activation: an Activate request with the canonical record, a restricted session after a restore, and the restore transaction in Ready, so that NVX's adapter drives the same sequence as the test adapter.

Today (dev d04d9fb): NVX's adapter speaks NVXC v1, whose requests are PING, EXEC, STOP, CANCEL, FEATURES and MAPS, and whose responses are READY, STDOUT, STDERR, EXIT, STOPPED and ERROR (nvx-rs/src/protocol/app.rs:11-93). The managed agent dispatches them (nvx-rs/src/guest/managed_agent/dispatch.rs:21-159). #821 moves NVX's adapter to NVXC v2, with a typed Ready that carries the application version, the guest build ID and the root profile, and embeds #838's ReadyActivation: the activation-configuration identity, with room for a clone's transaction ID. #821 also reserves the Activate request's type.

Implementation:

1. Activate: the request that nvx-rs: move NVX's adapter to NVXC v2 on the shared engine, with a validated Ready #821 reserves, carrying the canonical record of nvx::activation, at most 1,024 bytes. Its answer is Ready, or a typed activation error before the guest shuts down.
2. Ready's transaction: a clone fills the transaction ID in the ReadyActivation that nvx-rs: move NVX's adapter to NVXC v2 on the shared engine, with a validated Ready #821's Ready already embeds, and its configuration identity from its record. Ready's encoding doesn't change; a cold boot's Ready has no transaction ID.
3. Restricted session: after a restore, the guest accepts NVXS bootstrap and flow control, and one Activate. Any other NVXC request is a terminal protocol error. Retries follow nvx-rs: the restricted control state and Activate after a restore, in the guest library and the test adapter's framing #843's rules.
4. Codecs: the host and guest codecs for Activate in nvx::protocol, with conformance vectors in nvx-rs: turn the wire-format golden bytes into versioned conformance vectors #727's format for Activate, a clone's Ready and their rejections.
5. Host: nvx::host::session sends Activate, and checks Ready's configuration identity and transaction ID, through nvx-rs: restore clones from a template through Activate, Ready and Start #844's sequence.
6. Guest: the managed agent hands Activate to nvx::guest::clone::Activation (nvx-rs: the restricted control state and Activate after a restore, in the guest library and the test adapter's framing #843).

Tests: the vectors; a v2 session that refuses every request before Activate; identical and divergent retries; Ready's identity and transaction checked by the host; a cold Ready with the identity and no transaction.

Guide (#591's numbering): 4.4.1 (Activate), 4.4.2 (Ready's restore transaction), 4.4.4 (the protocol version).

Done when: merged with its vectors and tests.