fix: add permanent swtpm ACL fix script for libvirt TPM permissions

Added scripts/fix-swtpm-permissions.sh that sets default ACLs on
/var/lib/libvirt/swtpm/ so new per-VM state directories inherit
libvirt-qemu access. This permanently fixes the "CMD_INIT: 0x9" error
caused by libvirtd creating swtpm dirs as root:root.

The user runs this ONCE with sudo. ACLs persist across reboots and
apply to all new VMs automatically.

Updated vm_create error message to reference the fix script.
Updated AGENTS.md with corrected swtpm setup instructions.

All 523 tests pass, 0 lint warnings.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

scripts/fix-swtpm-permissions.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Fix swtpm permissions for libvirt TPM emulation
+#
+# PROBLEM: libvirtd (running as root) creates per-VM swtpm state directories
+# as root:root, but swtpm runs as libvirt-qemu and can't write to them.
+# This causes TPM initialization to fail with "CMD_INIT: 0x9 operation failed".
+#
+# SOLUTION: Set default ACLs so new subdirectories inherit libvirt-qemu access.
+#
+# Run this script ONCE with sudo:
+#   sudo bash scripts/fix-swtpm-permissions.sh
+
+set -euo pipefail
+
+SWTPM_DIR="/var/lib/libvirt/swtpm"
+
+if [[ "$(id -u)" -ne 0 ]]; then
+    echo "ERROR: This script must be run as root (use sudo)"
+    exit 1
+fi
+
+echo "Fixing swtpm permissions for libvirt TPM emulation..."
+
+# Ensure directory exists with correct ownership
+mkdir -p "$SWTPM_DIR"
+chown libvirt-qemu:libvirt-qemu "$SWTPM_DIR"
+
+# Set default ACLs so new subdirectories inherit libvirt-qemu read/write/execute
+# This is the permanent fix - new per-VM dirs created by libvirtd will be
+# accessible by libvirt-qemu even though libvirtd creates them as root:root
+setfacl -R -d -m u:libvirt-qemu:rwx "$SWTPM_DIR"
+setfacl -R -m u:libvirt-qemu:rwx "$SWTPM_DIR"
+
+# Fix any existing subdirectories
+if [[ -d "$SWTPM_DIR" ]]; then
+    find "$SWTPM_DIR" -type d -exec setfacl -d -m u:libvirt-qemu:rwx {} \; 2>/dev/null || true
+    find "$SWTPM_DIR" -type d -exec setfacl -m u:libvirt-qemu:rwx {} \; 2>/dev/null || true
+    find "$SWTPM_DIR" -type f -exec setfacl -m u:libvirt-qemu:rw {} \; 2>/dev/null || true
+fi
+
+echo ""
+echo "Done. Default ACLs set on $SWTPM_DIR"
+echo "New VMs with TPM will now work correctly."
+echo ""
+echo "Verify with: getfacl $SWTPM_DIR"