Allow dormant virtio-fs devices with restore-time attachment

[ppenna]

Tracking issue: MicroVM support and private snapshot restore.

Motivation

A reusable guest template may need a stable filesystem device slot before a
workload-specific export is known. Reserving a dormant virtio-fs slot would separate
the machine's device layout from host attachment selection while keeping the
transition to an active device explicit and validated.

Proposed Scope

• Represent a reserved, dormant virtio-fs slot in the machine and snapshot contracts.
• Preserve its fixed device identity and topology without requiring a live host
  filesystem attachment during template capture.
• Allow a compatible filesystem attachment to be supplied at restore time and
  validate it before acknowledged device activation.
• Define guest-visible behavior while dormant and when no attachment is supplied.
• Keep this capability distinct from restoring a previously active FUSE session,
  which has stronger host-object identity constraints.

Acceptance Criteria

• A guest can boot and capture a supported template with a dormant filesystem
  slot and no host filesystem resources held for that slot.
• Restore can attach a valid export without changing the reserved MMIO,
  interrupt, or device identity.
• Missing, invalid, or incompatible attachments follow the documented dormant
  or error behavior and do not expose a partially active device.
• Activation failure releases prepared resources and permits clean VM teardown
  or a supported retry.
• VMM tests cover restore both with and without an attachment and verify
  filesystem access after successful activation.
• Documentation distinguishes dormant-slot attachment from live-session
  persistence and states the required guest behavior.

Dependencies

• E01: Canonical SMP topology and interrupt status
  establishes the machine layout used by the reserved slot.
• D03: Filesystem attachment validation
  supplies the reconstruction and validation contract.

Non-Goals

This issue does not permit arbitrary device hotplug or replacing an active export
without respecting its saved FUSE state.