fix(discovery): derive the below-4G split robustly from fragmented mtree

host_probe derived the guest's below-4G split (vmie `low`) by taking the first
GPA-0 RAM run in `info mtree -f`. When low RAM is fragmented by overlay pages
(Hyper-V SynIC) and blackhole holes (smbase/tseg), that first run is a tiny
fragment, so the split came out far too small and host_bootstrap could never
recover the System DTB — the memctx context was never published.

Extract a pure parser, mtree_low_split(): anchor on the system flatview, take
`low` from the @file-offset of the high-RAM region at GPA >= 4 GiB (which equals
the split by construction), cross-validate against the PCI-hole base, and fail
closed when it can't be derived. QMP-reply un-escaping moves to the transport
boundary so the parser works on plain text. Unit-tested against a synthetic
fragmented flatview including a decoy non-system address space.

postinst also hints to restart the daemon after an upgrade (a running instance
keeps the old build until restarted).

Bump 0.3.6.

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.16)
 # Single source of truth for the version: CI passes -DVMSIG_VERSION=${TAG#v}, so the project
 # version (-> libvgpu-perception SONAME/.so version) and the .deb version come from one tag.
-set(VMSIG_VERSION "0.3.5" CACHE STRING "Release version (MAJOR.MINOR.PATCH); CI passes the tag")
+set(VMSIG_VERSION "0.3.6" CACHE STRING "Release version (MAJOR.MINOR.PATCH); CI passes the tag")
 project(vmsig VERSION ${VMSIG_VERSION} LANGUAGES C)
 
 set(CMAKE_C_STANDARD 17)
@@ -65,6 +65,7 @@ add_library(vmsig SHARED
         src/control/socket.c
         src/discovery/slot.c
         src/discovery/linux/host_probe.c
+        src/discovery/linux/mtree.c
         src/discovery/discovery.c
         # SI input driver (vmctl), absorbed in-tree (host-only: QMP + uinput)
         src/si/input/open.c
@@ -216,6 +217,15 @@ target_include_directories(vmsig_discoverytest PRIVATE
 target_compile_options(vmsig_discoverytest PRIVATE -Wall -Wextra)
 add_test(NAME discovery COMMAND vmsig_discoverytest)
 
+add_executable(vmsig_mtreetest src/test/test_mtree.c)
+target_link_libraries(vmsig_mtreetest PRIVATE vmsig)
+target_include_directories(vmsig_mtreetest PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/discovery/include)
+target_compile_definitions(vmsig_mtreetest PRIVATE
+        FIXTURE_DIR="${CMAKE_CURRENT_SOURCE_DIR}/src/test/fixtures")
+target_compile_options(vmsig_mtreetest PRIVATE -Wall -Wextra)
+add_test(NAME mtree COMMAND vmsig_mtreetest)
+
 add_executable(vmsig_daemoncfgtest
         src/test/test_daemoncfg.c
         src/daemon/config.c