review: whole-repo round on #285 (orphan sweep fix, FC detach check, deps, docs)

[CMGS]

Whole-repo review round on top of #285: every Go file (tests included), README and docs read in full against the code, dependencies and lint tools bumped.

Fixes

• hypervisor: false "killed orphan VMM" on force delete. The orphan sweep in deleteOneLocked walks a process scan taken before the force stop. A process that exited during the stop but is not yet reaped (Cloud Hypervisor's direct-boot pty child shares the VMM cmdline) still answers kill(0), so the sweep logged a kill that TerminateProcess then skipped on the cmdline check. The sweep now matches the cmdline, like the start path's scanFor. Regression test TestDeleteSkipsAScannedVMMThatExitedBeforeTheKill (Linux) fails without the fix and passes with it.
• firecracker: disk detach name check. Cloud Hypervisor rejects an invalid detach name up front. Firecracker took the ops lock and queried the VMM first, then reported success for a name that could never have been attached. Both backends now validate with disk.ValidateName before locking.

Cleanup (no behavior change)

• DoWithRetry uses range MaxRetries + 1; the arm64 kernel gunzip check reuses utils.GzipMagic; storebench seeds via slices.Chunk.
• The image index diff writes raw rows in both directions and reuses the bytes it already marshaled for the comparison. Snapshot size backfill reads the record's own data dir.
• Dead tar.TypeRegA branch dropped (archive/tar rewrites it to TypeReg on read).
• Tests: the gc policy tests parse the real gc command instead of a hand-copied flag set; the CH tests share one in-process handler transport instead of a second TCP stub; one dead fixture flag removed; slices.Equal replaces hand-written loops.
• Layout: contiguous small-struct fields in SnapshotExport, stray blank lines removed, stale omitempty comment corrected. Net comment count unchanged.

Docs

• Install links now point at v0.7.2, the latest release.
• vm disk attach --from-snapshot/--from-dir added where it was missing: the README highlights, the CLI tree, the devices intro, the index, snapshots (--to-dir consumers), and the known-issues sections on runtime-only devices and snapshot refusal.
• The vm debug doc now lists the cgroup CPU flags it ignores with a warning, matching the code.

Dependencies

go get -u ./... && go mod tidy: klauspost/compress v1.20.3, projecteru2/core v0.1.7, x/sync v0.24.0, x/sys v0.49.0, modernc.org/sqlite v1.60.1, plus indirect bumps. golangci-lint v2.14.0 (Makefile and lint workflow), gofumpt v0.12.0, goimports v0.51.0. google/uuid stays: the Go 1.27 stdlib uuid has no v5/NewSHA1.

Skipped, with reasons

• sync.Once singletons in cmd/core and Backend.topoOnce: their init takes conf/ctx, and tests reset them or build zero-value Backend literals, so OnceValue does not fit.
• The three advisory forwarder findings (instanceStart, pauseVM, quoteIdent) are recorded as kept in the hygiene ledger.

LOC

• Since the 2026-09-22 audit (868ffcf): prod 29365 → 29827 (+462), test 22238 → 23874. Features +338 (feat(disk): vm disk attach --from-snapshot/--from-dir attaches a snapshot's COW copy #285 +282, boot: hand arm64 OCI kernels to EDK2 over fw_cfg #271 +38, feat(disk): vm disk attach and detach are idempotent #282 +18), fixes/hardening about +191, review rounds −67. Comments are 4.5% of prod.
• No further cuts: everything else added in the window is backed by an incident or a feature request.
• This PR: prod +24/−24 (net 0), test +88/−48.

Verification

• make lint: 0 issues. for both GOOS=linux and GOOS=darwin. make fmt-check clean. asl ./... (both GOOS) reports only the three advisory forwarders above.
• go test ./... passes on darwin. go test -race ./... passes in golang:1.27.1 linux/arm64: 38 packages ok, 0 FAIL.