fix: harden VM readiness semantics and lifecycle cleanup

[xsoheilalizadeh]

Summary

• separate hypervisor execution state from guest readiness with Running and Ready
• add incremental serial-log readiness caching and use it in Apple VZ and Cloud Hypervisor state queries
• harden Cloud Hypervisor shutdown and sidecar cleanup paths, including reaping virtiofsd children consistently
• split the VM manager module by responsibility and update docs/CI to reflect the current verification surface

Verification

• cargo fmt
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets

Notes

• real hypervisor lifecycle tests remain opt-in because they still require signed binaries or external kernel/initramfs assets
• non-ignored Apple VZ FFI smoke tests are now part of normal macOS CI