microvm tooling: qemu-microvm engine, tap+NAT pools, cloud-init seeds (#615)

Firecracker-class microVMs for dev: 13-microvm-setup.sh (idempotent
installer) + microvm CLI + microvm-net.service (per-user tap pools,
/30s, NAT). Debian 13 cloud assets in /usr/local/lib/microvm/base.
Firecracker v1.16.1 installed but its KVM cap check is refused by this
nested Westmere KVM; qemu -M microvm engine default, FC retry after #601.

Details + UAT: https://projects.knownelement.com/issues/615

microvm/microvm-net.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# microvm-net.sh — host prep for microvm taps + NAT (idempotent; #615)
+# Run by microvm-net.service at boot, and by 13-microvm-setup.sh.
+set -euo pipefail
+
+# tap pool: mv-<prefix><slot>; per-tap /30 inside the user's /24
+POOLS=(
+  "reachableceo 172.30.0 r"
+  "reachableceo-offstage 172.30.1 o"
+)
+
+sysctl -qw net.ipv4.ip_forward=1
+
+for entry in "${POOLS[@]}"; do
+  read -r user subnet prefix <<<"$entry"
+  for slot in 0 1 2 3; do
+    tap="mv-$prefix$slot"
+    ip tuntap add mode tap user "$user" dev "$tap" 2>/dev/null || true
+    ip addr replace "$subnet.$((4*slot+1))/30" dev "$tap"
+    ip link set "$tap" up
+  done
+done
+
+# NAT for both pools (iptables-nft; coexists with docker chains)
+iptables -t nat -C POSTROUTING -s 172.30.0.0/23 -j MASQUERADE 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -s 172.30.0.0/23 -j MASQUERADE
+iptables -C FORWARD -s 172.30.0.0/23 -j ACCEPT 2>/dev/null || \
+  iptables -A FORWARD -s 172.30.0.0/23 -j ACCEPT
+iptables -C FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
+  iptables -A FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+echo "microvm-net: taps + NAT ready"
+ip -br addr | grep '^mv-'