fix(discovery): tolerate CRLF line endings in mtree parsing

mtree_low_split anchored the system flatview on "Root memory region: system"
followed by LF/space/EOF, but QEMU's HMP `info mtree -f` output is CRLF, so the
byte after "system" is '\r'. The anchor was rejected, the parser returned 0
(fail-closed), and on a real guest the daemon never attached the VM (low=0 =>
ok=0). The synthetic LF-only fixture hid this; the fix is verified against the
real CRLF output.

Accept '\r' in the anchor check (LF-only input still works) and add a regression
test that re-encodes the fixture as CRLF in memory.

Bump 0.3.7.

src/discovery/linux/mtree.c

@@ -95,10 +95,11 @@ static const char* find_system_flatview(const char* text, const char** body_end)
     const char* anchor = "Root memory region: system";
     const char* p = text;
     while ((p = strstr(p, anchor)) != NULL) {
-        /* The root name must end the token (newline/EOF) — reject "system.flash0" etc.,
-         * and reject roots that merely contain the word elsewhere. */
+        /* The root name must end the token (CR/LF/space/EOF) — reject "system.flash0" etc.,
+         * and reject roots that merely contain the word elsewhere. QEMU's HMP output is
+         * CRLF, so the byte after "system" is '\r'; accept it (LF-only input also works). */
         const char* after = p + strlen(anchor);
-        if (*after == '\n' || *after == '\0' || *after == ' ') {
+        if (*after == '\n' || *after == '\0' || *after == ' ' || *after == '\r') {
             const char* body = strchr(p, '\n');
             if (!body) return NULL;
             body++;                                  /* first region line                */