Rebuild runbook + state capture + docs sync to current reality (#615)

REBUILD.md maps a full rebuild (PVE qm spec incl. nested-virt flag,
guest OS/accounts/dotfiles bootstrap, script order, package baseline,
verification checklist). 14-capture-state.sh regenerates docs/state
snapshots (guest apt/units/sysctl/fstab/docker + PVE 5111 config).
Docs sync: stale multiqueue-owed text removed from NEXT/REPORT/RUNBOOK;
README script list + open-work list current.

Details: https://projects.knownelement.com/issues/615

NEXT.md

@@ -20,12 +20,11 @@
 - All guest tuning live and verified (see 16:04-16:15 pass below).
 - Host flags live: ssd=1/discard (ROTA=0), iothread, onboot=1, startup
   order=10, cpuunits 9000/50, ide2 gone.
-- Net multiqueue: queues=4/2 now IN live qm config (staged 16:40 by crush
-  via ssh); activates at the next VM start — ONE reboot still owed, human-
-  timed: run ~/projects/ultix/5-activate-multiqueue.sh (kills crush
-  sessions, ~4 min). HUMAN 2026-08-31 eve: nothing else is running on this
-  system — bounce THIS SESSION, right after the remaining session tasks.
-  Guest oneshot ukrrs-net-multiqueue auto-runs ethtool -L on that boot.
+- Net multiqueue: DONE + verified 2026-09-01 (bounce 22:51->22:53; ens18
+  4/4, ens19 2/2). 5-activate-multiqueue.sh is historical record.
+- 2026-09-01: microvm tooling LIVE (#615: microvm CLI, qemu-microvm
+  engine, per-user tap pools + NAT; firecracker blocked by nested-KVM
+  caps until #601 hardware) + REBUILD.md/docs/state capture landed.
 - Gateway boot-race + live-restore endpoint loss: permanently fixed by
   ukrrs-gateway-ensure unit (enabled, both lanes).
 - Root cause of the 15:59 no-op: the script copy executed then predates the