Add a host-readiness preflight (extend `vmkit doctor`) that refuses to start a series under insufficient free memory

[nloum]

Summary

vmkit doctor validates the host's toolchain/config, but nothing validates that the host has enough free memory to actually run the target guest. A series that starts when the host is already near its memory ceiling proceeds straight into an OOM and produces confusing, product-looking failures.

Evidence

portzero run 30092755473: a test subprocess was OOM-killed and the run flaked (see #3). A preflight that checked free memory against the target guest's configured RAM would have either waited or failed fast with a clear reason instead of producing three misleading assertion failures.

Proposed behavior

• Add a host-readiness check (either a new vmkit doctor check, or a preflight run automatically at the start of series) that compares available host memory against the target guest's configured RAM (plus headroom for the harness).
• If insufficient: either wait with a visible countdown until memory frees (dovetails with series starts/reset the next guest before the previous is fully stopped and its RAM reclaimed, causing host OOM #3), or fail fast with an actionable message — e.g. host has 812 MB free but guest 'Ubuntu Linux' needs 4 GB; free memory or close other apps/VMs.
• Make the headroom/threshold configurable via host.conf.

This is the "check before you leap" complement to #3 (block during handoff), #4 (observability), and #5 (free RAM faster by shutting down instead of suspending).