Regular-VM lane proven: libvirt q35 works nested, ops note added (#615)

Full VMs run on the workstation (q35 + host-passthrough + KVM): Debian
cloud guest reached DHCP + ssh + running systemd. REGULAR-VMS.md holds
the recipe and the three workstation gotchas (disk perms under images/,
/boot-only kernels for virt-aa-helper, console=ttyS0 for serial).

Details: https://projects.knownelement.com/issues/615

README.md

@@ -35,4 +35,6 @@ are manual-only by ruling.
   14-capture-state.sh (refresh docs/state). staged/ holds the gated configs.
 - OPEN-TERMINAL.md — ops note for the terminal fleet: ports, keys location,
   production OpenWebUI wiring, UAT record.
+- REGULAR-VMS.md — running full (non-micro) VMs here: libvirt/AppArmor
+  rules, working recipe, test record (#615).
 - crush.md = session preferences for agents working in this repo.