Add vmctl_key_held, vmctl_btn_held, vmctl_keys_snapshot and
vmctl_btns_snapshot, exposing the down-state each handle last actuated.
Two bitmaps in the handle (keys by evdev KEY_*, buttons by VMCTL_BTN_*)
are updated after a successful send in vmctl_batch_send; the send path
never reads them. VMCTL_KEY_CODE_MAX and VMCTL_KEYS_SNAPSHOT_BYTES give
callers the keys-snapshot buffer size.