fix(minimald,minimal): power the microVM off when the guest daemon stops - #734

minimald is the microVM's pid-1, so returning from `main` after the
Shutdown RPC drained the server killed init: the kernel panicked
("Attempted to kill init!") and, with no `panic=` on the cmdline, spun
in the panic handler. The VMM child stayed alive on a dead guest, the
host kept reporting the VM as Running, and every later CLI command
blocked on a bridge socket nothing was behind — so `min stop --force`
bricked the daemon until the VM was killed by hand.

Power the VM off instead (sync + reboot(RB_POWER_OFF)), on the clean
and the failed exit alike: libkrun's VMM exits with the guest, the
supervisor reaps it and writes Stopped, and the next command autospawns
a fresh VM.

Two supporting changes on the CLI side:

- Bound the SSH handshake (10s). A connect is not proof of a live
  daemon — libkrun's bridge accepts even when the guest behind it is
  wedged — so any future guest wedge now errors instead of hanging.
  minvmd's own client already guards this; the CLI's did not.
- `min stop` waits for the VM to reach a terminal lifecycle state
  before returning, so the next command spawns a fresh VM rather than
  racing a Running state whose VM is already going down.

The session e2e now asserts both halves: after `minimal stop` the VM is
Stopped, and the next `minimal ls` brings a daemon back.

Closes: #730

`Client::connect(...).unwrap_err()` requires `Client: Debug`, which it
does not implement, so `cargo test -p minimal` failed to build and the
test never ran. Map the Ok side to `()` to drop the bound.

Verified against a real microVM: the pre-fix guest panics the kernel
("Attempted to kill init!") on shutdown, while the fixed guest powers
off and the session e2e passes on the VM lane.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

`RB_POWER_OFF` only takes the VM down on aarch64. It needs a
`pm_power_off` handler, and the x86_64 guest kernel has none: the kernel
logs "Power off not available: System halted instead" and halts the vCPU
with the VMM still alive — which is #730 again, the very wedge this was
meant to fix. aarch64 has PSCI SYSTEM_OFF, so the arch gap was invisible
locally and only surfaced on CI's x86_64 KVM lane.

Reset instead: a guest-initiated reset is what makes a firecracker-family
VMM exit, and it reaches KVM_EXIT_SHUTDOWN on both arches (PSCI
SYSTEM_RESET on aarch64, i8042 reset / triple fault on x86_64). libkrun
exits on it rather than restarting the guest, so it ends the VM despite
the name.

Rename `power_off` to `shut_down_vm`, since it no longer powers off, and
note that it must only be called as the microVM's pid-1 — on an ordinary
host it reboots the machine.

Verified on aarch64: the session e2e passes on the VM lane, the guest
logs "reboot: Restarting system", the VM reaches Stopped and the next
command autospawns a fresh one. The x86_64 KVM lane is the check that
caught this.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Review follow-ups on #730.

The guard that decides "am I the microVM's init" now also gates
`reboot(2)`, and it keyed on `argv[0]` alone — which the caller
controls. `exec -a init minimald` on a host with CAP_SYS_BOOT would
have reset the machine when the process exited. Require pid-1 as well:
that cannot be spoofed from userspace, and while a native daemon could
be a container's init, it would not also be named `init`. Only the
microVM's init satisfies both. Split out a pure `is_microvm_init(pid,
argv0)` so the spoofing cases are testable.

If the reset syscall fails, pid-1 no longer falls through and returns:
that would exit init and panic the guest kernel — the exact wedge #730
is about. Park instead, as the boot path's degraded arms already do, so
the kernel stays idle (no panic-handler spin) and `minvmd stop`'s
SIGTERM can still reap the VMM.

Also:

- The handshake-timeout error no longer claims the peer is a daemon;
  the connect path is shared with providers that are not (Tom).
- `min stop`'s wait runs on the blocking pool rather than stalling an
  async worker for up to 20s (rust-coding-standards).
- session-e2e.sh matches `minvmd status`'s exit code exactly (0 running,
  1 stopped) instead of reading any non-zero exit as "stopped", which
  would mask a missing binary or a lock-contention (2) failure.