feat(block): support live capacity growth

[appcypher]

TL;DR

Add grow-only capacity updates for an owned writable block device while the VM is paused. The guest receives a virtio configuration notification after the disk and request bounds have been updated.

Description

• Add VmControl::grow_block_capacity(device_id, size_bytes) for raw and qcow2 backends.
• Drain the block worker before changing capacity and preserve its backing chain, writeback policy, and host handles.
• Reject shrinking, unaligned sizes, read-only devices, and updates outside a paused boundary.
• Leave filesystem expansion and recovery after partial I/O failure to the caller.
• Stack on feat(state): add reversible virtio device state #122 without importing unrelated main changes.

let pause = control.pause()?;
control.grow_block_capacity("vdb", 8 * 1024 * 1024 * 1024)?;
control.resume(pause)?;
// The caller then expands the guest filesystem and verifies completion.

Test Plan

• cargo test --offline -p msb_krun_devices --features blk passes 135 tests.
• cargo check --offline -p msb_krun --features blk succeeds.
• cargo fmt --all -- --check and git diff --check pass.
• macOS/HVF managed and flat roots pass raw, qcow2, repeated, compacted, partial-group, stopped, deferred, and old/new full-restore checks through the caller runtime.
• Linux/KVM and Windows/WHP live qualification (source transfer awaits owner approval).

[appcypher]

Integrated recovery qualification completed at head 6b61025 on 2026-09-07: six Linux/KVM and six native Windows ARM64/WHP live fault runs passed, covering one/two vCPUs with three repetitions each. Device workers were quiesced before partial tracking-disable/remap failure; resume-before-rebase recovered, and subsequent deltas matched fresh full RAM with zero mismatches. This tests the inherited #122 ordering on the actual #124 integration. All nine CI checks pass. This batch is recovery qualification, not a new capacity-growth benchmark. Minimal filesystem durable serialization and the separate Windows pre-tracking host-read failure remain explicitly outside these passing assertions. Earlier README remote-approval pending entries are superseded by these results.