feat(uffd,fc): wire balloon free-page-reporting

[ValentaTomas]

Wires Firecracker balloon free-page-reporting through the template build into pkg/sandbox/fc. In the orchestrator path FPR turns on only when fcInfo.HasFreePageReporting() (FC v1.14+) AND the free-page-reporting LaunchDarkly flag are both true; cmd/create-build defaults to the FC-version-derived value and accepts an explicit --free-page-reporting override.

Depends on #2545 → #2520 — without the REMOVE-event handling from #2520, FC's madvise(MADV_DONTNEED) on balloon deflate would race in-flight pagefault workers.

[cursor]

PR Summary

Medium Risk
Touches VM lifecycle and snapshot/diff metadata paths (Firecracker API config + UFFD dirty/empty tracking), so mis-gating by version/flag or incorrect bitmap handling could lead to resume corruption or runtime failures. Rollout risk is mitigated by version checks (v1.14+) and a feature flag, but the new defaults/overrides should be validated across upgrade/downgrade scenarios.

Overview
This PR plumbs a new FreePageReporting setting from template creation/build inputs into sandbox runtime so Firecracker can enable balloon free-page-reporting (defaulting on for FC v1.14+ and gated by a LaunchDarkly flag, with an explicit cmd/create-build --free-page-reporting override), and updates snapshot diff generation to treat UFFD REMOVE’d pages as Empty so freed guest pages restore as zero rather than leaking stale data; key things to double-check are the FC-version parsing/compare (suffix handling), behavior when the version check fails (silent fallback), and that the new dirty∩empty masking doesn’t accidentally drop real dirty pages under unexpected FC/host behavior.

^{Reviewed by Cursor Bugbot for commit 417ed97. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d472bdf. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6faaefab87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".