add reliability diagnostics and recovery

[NetVar1337]

Summary

• diagnose host, IOMMU/VFIO, donor power, BAR health, and Vivado failures with stable codes
• guard host-critical devices and transactionally restore complete VFIO groups
• verify flash artifacts and compare donor/emulator initialization sessions
• collect bounded Windows Code 10 evidence and define class/xHCI initialization contracts
• harden capability/MMIO parsers with fuzz targets and sanitized failure fixtures

Safety

• destructive operations fail closed when root-filesystem or default-route ownership cannot be classified
• restoration state rejects non-canonical BDFs and unsafe driver paths
• xHCI resets halted and host-owned; Run/Stop controls HCHalted

Verification

• make check
• make hdl-lint
• MMIO and PCI capability fuzz smoke runs

Stacked on sercanarga#79. After sercanarga#79 merges, retarget this branch to upstream main and open the upstream PR.