Define generation IDs, restore entropy, and VP targets

[ppenna]

Tracking issue: MicroVM support and private snapshot restore.

Motivation

Cloning a prepared guest must not silently reuse state that is intended to be
instance-specific. Generation changes and fresh entropy need a guest-visible
contract, and requested VP targets must agree with the saved topology. The host
also needs to know when guest-side repair is complete before exposing the instance
as ready for work.

Proposed Scope

• Define generation-ID handling for restored instances and make the intended
  transition observable to the guest.
• Provide gated restore-time entropy using an appropriate host source, only when
  the guest contract supports consuming it safely.
• Validate requested VP restore targets against the supported topology, capacity,
  and processor-state contract.
• Add a guest repair/readiness protocol that orders identity refresh, entropy
  consumption, and VP preparation before workload readiness.
• Bound waiting and propagate unsupported capabilities or repair failures through
  the restore transaction.

Acceptance Criteria

• Independent clone restores observe distinct generation identities under the
  documented policy.
• Controlled tests verify entropy delivery, capability gating, and host entropy
  failure without relying on probabilistic uniqueness assertions.
• Unsupported or out-of-range VP targets are rejected before affected VPs run.
• A source-built guest demonstrates the repair/readiness handshake and does
  not report workload readiness before required repair completes.
• Missing acknowledgment, cancellation, and repair failure produce bounded
  outcomes with clean teardown.
• Documentation states guest responsibilities and makes clear that supplying
  entropy alone does not repair every guest-cached identity or random state.

Dependencies

• E02: Dormant filesystem slots and restore-time attachment
  establishes the restore-time preparation sequence to extend.
• E01: Canonical topology supplies VP identity and
  topology validation.

Non-Goals

This issue does not promise transparent cloning of unmodified guests or arbitrary
CPU hotplug. Snapshot capture tiers and block-role policy are defined separately.