feat(vm): add vm life cycle extensions

[cheese-head]

Summary

Adds lifecycle extension points to the VM driver so future integrations can inspect and adjust VM launch plans around sandbox startup and cleanup. The default registry is empty, so existing VM sandbox behavior remains unchanged.

Related Issue

Not linked

Changes

• Added a VM lifecycle extension trait, registry, launch plan, and lifecycle error type.
• Wired VM provisioning to run lifecycle hooks before launcher spawn, on launch failure, and after sandbox deletion.
• Kept backend selection stable by rejecting non-GPU QEMU extension requirements until concrete PCI transport exists.
• Tracked QEMU network allocation separately from GPU assignment so cleanup does not depend on GPU state.
• Added unit coverage for lifecycle hook ordering, cleanup hooks, backend validation, and resource exhaustion handling.

Testing

• mise run pre-commit passes (not run; mise is not available in this shell)
• Unit tests added/updated
• E2E tests added/updated (not applicable)

Additional validation run:

• cargo fmt -p openshell-driver-vm
• cargo test -p openshell-driver-vm lifecycle -- --nocapture
• cargo test -p openshell-driver-vm qemu -- --nocapture
• cargo clippy -p openshell-driver-vm --all-targets -- -D warnings
• cargo test -p openshell-driver-vm
• git diff --check

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.