Run resumable global creation hooks

[ESultanik]

Run a configured global post_create command inside each new VM after file
copying, agent bootstrap, and workspace provisioning. Save its recipe and
completion in private per-instance storage. Failed or interrupted setup retains
the VM for shell/exec debugging, blocks agent launch, and resumes on up or a
stopped-instance restart. The deferred post_start command runs after creation
succeeds; completed hooks are skipped on ordinary restarts and reset by restore.

Serialize creation attempts with provisioning, keep guest environment values
off host subprocesses, and terminate failed or interrupted guest process groups.
Devcontainer files remain ordinary workspace data. Creation recipes contain only
global shell commands; removed project stages and argv recipes are rejected.

Stacked on #514.

Validation: workspace tests (1,218 coop, 30 proxy, and eight proxy integration), format, clippy, taplo, cargo-deny, and normal pre-commit hooks passed. Mutation testing caught all 22 viable mutants (four unviable, none missed); deliberate project-state, argv-recipe, and shell-quoting regressions failed their intended assertions.

Full Lima integration passed: 510 passed, zero failed, 13 skipped. Full Firecracker integration passed: 518 passed, zero failed, ten skipped. Both runs covered all 14 creation-hook assertions, guest-file copying, required proxy behavior, and recovery. Skips reflect platform differences, unavailable status fields, preservation of an existing user VM, and disabled destructive tests.

[ESultanik]

Merge/readiness checklist for this PR:

Stack order: #512 → #513 → #514 → #516. Each PR should ultimately merge into main, in that order; do not merge a follow-on PR into its current feature-branch base.

After a predecessor merges, retarget the next PR to main (verify the base even if GitHub updates it automatically). Integrate main with a merge commit if needed, resolve conflicts, and check that the final diff contains only that PR's intended change. Preserve published history: no force-push/rebase is needed. Refresh required CI and review; repeat validation affected by any changes to the tested tree.

• Merge Copy configured guest files before agent bootstrap #514, then retarget this PR from feat/guest-files to main.
• Complete Firecracker VM integration for this PR's candidate and record the results below.
• Confirm the final diff, required CI, and maintainer review; mark ready once the platform gate passes, then merge into main.

Current evidence at 23cf11417bccfd4187c7b37ad0951ccc064d6f4b: the final full Lima run completed with 515 passed, zero failed, nine skipped, and runner exit zero. Workspace checks, scoped creation-hook/devcontainer mutation testing, and Linux CI pass. Implementation and documentation are committed. Firecracker VM integration remains unrun because a test host has not been supplied; that is why this PR remains a draft.

Use a clean checkout of this PR's final candidate and a Linux SSH host with working KVM/Firecracker access and the remote full-suite prerequisites. The full run needs the documented build/network tools and passwordless sudo. Run these suites serially on a shared host because they rebuild shared test images.

git rev-parse HEAD
./tests/run-integration.sh --full --remote user@host --name coop-pr-516

Replace user@host with the available test host. Confirm that global/project failure and retry, saved recipes and argv boundaries, agent gating, restore/reprovision, cancellation/descendant cleanup, and retries during failed or paused provisioning execute and pass.

Post the tested commit SHA, host architecture, runner exit status, pass/fail/skip counts, and a log link or attachment here. Inspect skipped phases; a zero exit alone is insufficient if relevant coverage was skipped. Linux CI does not substitute for Firecracker VM integration. A run of #516 alone provides combined-stack evidence, not proof that each earlier PR's exact candidate was tested.

#515 tracks the pre-existing postStartCommand array bug separately; it is not required for merging this feature.

[hbrodin]

Review summary: one inline lifecycle finding; no diff-noise notes. I reviewed correctness, design, conventions, security, API usage, tests, docs, and comments against efe2d3879d4d913de62a5d1d1201a36db7fdb20e. git diff --check passed. I did not rerun unit tests or Lima/Firecracker integration. The linked Firecracker job passed on earlier SHA 8570a3abcadca6b54984fec3f5e66dfff91fda1c, so the VM gates are not verified for this head.