guest: apply the DNS server and listener announcements of a replaced policy after a non-sandbox restore #943

Parent: #800, finding 2. Needs: #942 in NVX's OpenVMM pin.

Baseline: origin/dev at 1ee64892, which pins OpenVMM d2338ea2. Every link uses one of those revisions.

Goal. #942 lets a restore replace the policy of a NIC template without a tier. A non-sandbox guest restored that way learns its DNS server, and whether to announce its listeners, from the new policy, and nvx-rs run --restore-snapshot can request the replacement.

Today:

• The non-sandbox guest configures its network once, at boot, from the virtnet_* tokens of its kernel command line (init#L175-L276). It takes its DNS server from virtnet_dns (#L235-L249), and starts nvx-ingress for virtnet_ingress (#L251-L263).
• OpenVMM writes those tokens from the boot's policy (command_line_fragment_with, microvm_ingress), and the snapshot keeps the command line. A template's guest, captured under the complete deny-all, therefore has no DNS server and starts no nvx-ingress.
• Its post-restore repair does no network work (nvx-snapshot#L290-L411), and restore packet v4 carries no network settings (5.5.5).
• Platform clones learn these settings from their activation record (nvx-rs: a canonical activation record for platform clones #838), and nvx-rs: per-clone network policies on deny-all templates #850 starts their announcer. The non-sandbox mode has no activation record.

Without this, a policy replaced at restore changes only what the host enforces: the guest resolves no names, and ingress and explicit host loopback publish none of its listeners.

Implementation:

1. Host: at a restore of a snapshot without a tier with --restore-network-policy, OpenVMM hands the guest's repair the DNS server and the announcement mode of the restore's policy, which it derives as at a cold boot, for example through a new version of the restore packet (5.5.7). Version the change, so that an older guest fails such a restore instead of ignoring the settings.
2. Guest: the repair writes /etc/resolv.conf, and starts nvx-ingress at the gateway, as the settings ask, before the host releases its input, and fails the restore when it cannot.
3. nvx-rs run: pass --restore-network-policy on a restore, and admit with it the ingress, explicit host loopback, and forwards that OpenVMM admits. Update the Networked snapshots section of doc/run.md, the run table of doc/usage.md, and 3.5.6 of the architecture guide.

Tests: a test-microvm scenario that captures a non-sandbox NIC template and restores it on KVM, MSHV, and WHP with egress rules and DNS, a forward, explicit host loopback, and private-network ingress, and checks the guest's resolver and the listeners that the host publishes; tests of the guest's repair; and nvx-rs CLI tests for the option.

Done when: merged, with the same-policy rule for snapshots without a tier gone from the guides.