vmm: add mmap memory restore mode

[CMGS]

What

Adds a third memory_restore_mode value, mmap: restore guest RAM by mapping the snapshot memory file copy-on-write over the still-unconsumed private anonymous guest mappings, before any KVM memslot, device or thread consumes them. Nothing is copied up front, pages fault in from the page cache — so VMs restored from the same snapshot share it — and guest writes stay private per VM. Opt-in; the default copy path is byte-for-byte unchanged.

Why this does not hit the historical mmap objections

• The mapping is established at region-creation time, not overlaid after KVM slot registration — the mapping-identity problem that motivated rejecting an mmap overlay (upstream vmm: memory_manager: add userfaultfd demand-paged snapshot restore cloud-hypervisor/cloud-hypervisor#7800) and removing the 2020 CoW-restore path does not arise.
• The 2020 removal's second reason (re-snapshot skipping file-backed regions) no longer applies: the sparse-writer skip requires MAP_SHARED + matching file identity; the MAP_PRIVATE overlay never hits it, and a re-snapshot densely copies actual CoW memory (verified in review).

Constraint gate (falls back to eager copy, logged)

• Per region: anything file/memfd-backed (shared or hugepage RAM, global or per-zone) is rejected via file_offset(); only plain private-anonymous regions are overlaid.
• Per config (Vm::new): device passthrough (--device/--user-device), --pvmemcontrol, KSM (mergeable=on), resizable RAM (hotplug_size), and zones with numa/reserve/mergeable/hotplug attributes. A purely static id+size zone takes the mmap path.
• A snapshot file shorter than the saved ranges is rejected up front (would otherwise SIGBUS at run time); prefault is rejected; reserve/THP policy is re-applied to the mapped region.
• The snapshot file must remain on disk and unchanged for the VM lifetime (stronger than ondemand; documented).

Evidence

• Measured on a 16-core host (same binary, only the mode switched, 3 interleaved rounds, 512MB guests): serial clone p50 54-58ms → 22-35ms; 16-way clone burst per-clone p50 443-463ms → 72-82ms (−82%), wall 456-478ms → 87-108ms. Cloned VMs boot and exec normally.
• nightly cargo fmt --check 0 diff; cargo clippy -p vmm --features kvm --all-targets -- -D warnings clean (also kvm,pvmemcontrol); 4 unit tests cover CoW mapping + hole-reads-zero + CoW isolation, file-backed-region rejection, unaligned/spanning rejection, reserve/THP path.
• Four adversarial review rounds; all findings addressed (per-zone backing gate, EOF pre-check, VMA policy replay, checked arithmetic, pvmemcontrol fallback, doc precision).