SO3 v6.3.1

Patch release on the 6.3 line, carrying the capsule snapshot rework and the
networking work which had landed on main since v6.3.0.

Capsule snapshots

Saving or restoring a capsule made the agency allocate a DMA buffer as large as
the whole snapshot — 128 MB of physically contiguous memory on virt64, taken
from a 160 MB CMA zone while the engine held a copy of the same snapshot in user
space. The allocation failed, and the agency died on a BUG_ON() in an ioctl
with the interrupts off.

The snapshot is now streamed through a 4 MB bounce buffer, reserved once at init
while the CMA zone is still pristine. Neither pause nor resume depends on a
large contiguous allocation any more, and the snapshot is no longer held twice
in RAM.

A snapshot can also be taken without resuming the capsule
(AVZ_STAGE_FINALIZE_HOLD), for a caller which shuts it down right after.

Robustness around the capsule lifecycle

• sizes coming from user space are bounded and their allocations report
  -ENOMEM instead of taking the machine down, on both the snapshot and the
  injection paths; the capsule image is read with copy_from_user();
• a snapshot which fails halfway no longer leaves the capsule suspended for
  good;
• the console focus skips a capsule which cannot take the input, and the send
  path no longer sleeps in the serial interrupt waiting for a frontend that is
  gone — which used to freeze the console;
• a capsule which cannot answer the DC_SHUTDOWN handshake (suspended, stopped,
  or killed after a fault) no longer leaves its backends registered and its
  vbstore entries behind, so its slot can be reused;
• AVZ frees the grant table of a domain destroyed before it revoked its grants.

Validated on virt64 through the EMISO Docker API: six consecutive pause/resume
cycles, no BUG(), no oops.

Networking

Ethernet on virt32 and virt64: the SMSC LAN9118 the QEMU machine model now
provides, the lwIP socket path, and ping reporting what it actually got.

Build system

The developer container gained dbuild.sh conveniences, the TEZI feed is served
from the tree, and sudo is probed with a real command so a NOPASSWD sudoers no
longer stops a build.