Scope host-global resources to a per-installation instance id

[aljoscha]

Summary

Two ember installations on the same host previously shared the dm-thin
pool name (ember-pool), the em-* TAP namespace, the 10.100.0.0/16
default subnet, and — on macOS — vmnet's 192.168.64.0/24. Worse,
reconcile() listed every em-* interface and would delete the other
install's TAPs on any command; deinit --purge tore down the singleton
ember-pool regardless of which install was asking. An integration
test against a temp --state-dir could destroy a live install on the
same machine.

This branch introduces a 4-hex-char instance_id (derived from a hash
of the canonicalized state-dir at ember init, overridable via
--instance-id) and threads it through every host-global resource
name.

What gets scoped

• dm-thin: ember-{id}-pool, ember-{id}-img-, ember-{id}-vm-
• Networking (Linux): em{id}- TAP prefix (14-char names fit
  IFNAMSIZ), ember:{id} iptables comment threaded through every
  add/remove so cleanup only ever matches this install's rules
• IP subnet (Linux): /16 slot inside 10.0.0.0/8 derived from
  the id; overridable via --ip-subnet
• IP subnet (macOS): vmnet's /24 sub-allocated into 8× /27 slices
  picked by the low 3 bits of the id (1/8 collision per pair; the
  override is --ip-subnet)
• macOS guest IPs: replaced the Linux /30 P2P allocator with a
  single-IP /32 allocator since vmnet is a shared L2 bridge. Lifts
  the per-install cap from 8 to ~30 VMs while staying inside the /27.

reconcile() now scopes the orphan-TAP sweep by the install's prefix
and skips it entirely if the config can't be read (preferable to
deleting a foreign device).

Boundary discipline

GlobalConfig does not own the format of any subsystem's names. It
exposes one generic accessor — instance_namespace() -> Option<&str>,
which collapses the empty-string legacy sentinel to None — and each
subsystem owns its own pure derivation next to the code that has to
match the literals byte-for-byte:

• dm_thin::pool::name(Option<&str>)
• dm_thin::thin::{image_prefix, vm_prefix}(Option<&str>)
• network::tap::prefix(Option<&str>)
• network::nat::comment(Option<&str>)
• ember_linux::network::ip::derive_default_subnet(...) (Linux /16 in /8)
• ember_macos::network::derive_vmnet_subnet(...) (macOS /27 slot)

Added a one-bullet style note in CLAUDE.md capturing the principle.

Back-compat

No deinit --purge && init migration required. Older configs lack
instance_id; instance_namespace() returns None and each
subsystem falls back to its historical literal (ember-pool, em-,
ember-img-, ember-vm-, empty iptables comment, full /24 on macOS).

The subtle one is iptables: older binaries added rules without
-m comment at all, so on -D the comment match has to be elided
or the rule won't match. Handled in network::nat.

Risk

• Cross-install isolation is invariant-level: covered by three
  integration tests in tests/isolation.rs that go through the
  binary — two-install dm-thin non-interference, legacy config
  compatibility, scoped TAP reconcile.
• macOS /27 collision is probabilistic (1/8 per install pair).
  Acceptable for personal use; --ip-subnet is the escape hatch.
• macOS allocations.json layout is preserved byte-for-byte for
  legacy installs (no instance_id → keep the /30 allocator on the
  full /24); new installs get the /32 allocator on the /27.
• derive_vmnet_subnet on bad instance_id panics rather than
  silently falling back to slot 0 (which would re-collide every
  affected install on the same slice). The id is CLI-validated or
  auto-derived, so this is unreachable in practice — the panic is
  there to catch a regression in validation.

Test plan

• cargo test (229 unit tests pass)
• cargo test --test isolation (three cross-install tests)
• cargo test --test dm_thin -- --ignored on a host with the
  dm-thin module + thin-provisioning-tools
• Manual: two ember init invocations against distinct
  --state-dirs on the same Linux host; create VMs in both;
  deinit --purge on A leaves B running
• Manual: upgrade a pre-existing install in place (no re-init);
  verify VMs keep working and deinit cleans up old iptables
  rules
• Manual macOS: two installs running VMs concurrently; verify
  distinct /27 slices and no guest-IP collisions