fix(discovery): derive the below-4G split robustly from fragmented mtree

host_probe derived the guest's below-4G split (vmie `low`) by taking the first
GPA-0 RAM run in `info mtree -f`. When low RAM is fragmented by overlay pages
(Hyper-V SynIC) and blackhole holes (smbase/tseg), that first run is a tiny
fragment, so the split came out far too small and host_bootstrap could never
recover the System DTB — the memctx context was never published.

Extract a pure parser, mtree_low_split(): anchor on the system flatview, take
`low` from the @file-offset of the high-RAM region at GPA >= 4 GiB (which equals
the split by construction), cross-validate against the PCI-hole base, and fail
closed when it can't be derived. QMP-reply un-escaping moves to the transport
boundary so the parser works on plain text. Unit-tested against a synthetic
fragmented flatview including a decoy non-system address space.

postinst also hints to restart the daemon after an upgrade (a running instance
keeps the old build until restarted).

Bump 0.3.6.

packaging/deb/vmsig/postinst

@@ -11,7 +11,17 @@ configure)
         systemd-tmpfiles --create /usr/lib/tmpfiles.d/vmsig.conf || true
         systemctl enable vmsigd.service || true              # enable, but do NOT start
     fi
-    echo "vmsig: review the [grant] policy in /etc/vmsig/vmsigd.conf, then: systemctl start vmsigd" >&2
+    if [ -z "$2" ]; then
+        # fresh install ($2 empty): enabled but NOT started — the operator reviews the
+        # grant policy before the first start.
+        echo "vmsig: review the [grant] policy in /etc/vmsig/vmsigd.conf, then: systemctl start vmsigd" >&2
+    else
+        # upgrade ($2 = old version): a running daemon keeps the OLD in-memory image until
+        # restarted — the new build is not applied automatically. Not auto-restarted here:
+        # the start is gated on the grant policy, so the operator owns the moment. try-restart
+        # touches the daemon only if it is currently running (leaves a stopped one alone).
+        echo "vmsig: upgraded from $2 — a running daemon still runs the old build; apply with: systemctl try-restart vmsigd" >&2
+    fi
     ;;
 abort-upgrade|abort-remove|abort-deconfigure)
     ;;