feat(fc): drain virtio-balloon free-page-hinting before pause

[ValentaTomas]

Drains virtio-balloon free-page-hinting before pause so snapshots don't capture pages the guest already considers free. The balloon (from parent FPR PR) always arms FreePageHinting=true; on pause we call start_balloon_hinting and poll describe_balloon_hinting until guest_cmd >= host_cmd (with host > 0 guard). Reclaimed pages emit UFFD_EVENT_REMOVE, already tracked by parent.

Gated by free-page-hinting-timeout-ms LD flag (ms; default 0 = disabled). Operator opts in once the kernel has the FPH race fix. Stacked on parent FPR branch for the shared balloon-install path; split out from #2550.

[cursor]

PR Summary

Medium Risk
Touches the Firecracker VM lifecycle and snapshot/pause path and adds new polling logic against FC balloon APIs; although gated by a feature flag and designed to no-op when unsupported, regressions could impact snapshot latency or pause reliability.

Overview
Adds an optional pre-pause "balloon drain" that triggers virtio-balloon free-page-hinting and waits for guest acknowledgement so snapshots avoid capturing pages the guest already considers free, gated by the free-page-hinting-timeout-ms feature flag (default off) with an override exposed in resume-build. This also refactors balloon setup into an installBalloon call that can enable free-page-reporting and free-page-hinting independently based on Firecracker/kernel support, and extends version gating to detect the FC free-page-hinting API.

^{Reviewed by Cursor Bugbot for commit 7619cc9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bf00edc. Configure here.}