microvm tooling: qemu-microvm engine, tap+NAT pools, cloud-init seeds (#615)

Firecracker-class microVMs for dev: 13-microvm-setup.sh (idempotent
installer) + microvm CLI + microvm-net.service (per-user tap pools,
/30s, NAT). Debian 13 cloud assets in /usr/local/lib/microvm/base.
Firecracker v1.16.1 installed but its KVM cap check is refused by this
nested Westmere KVM; qemu -M microvm engine default, FC retry after #601.

Details + UAT: https://projects.knownelement.com/issues/615

microvm/microvm-net.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=microvm tap pool + NAT for user microVMs (#615)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/microvm-net.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target