vmsig: management daemon, runtime endpoint lifecycle, roster, discovery, in-tree drivers, packaging

- core: runtime attach/detach of a per-endpoint adapter trio (runtime-safe add_adapter + vmsig_core_detach_endpoint, deferred reap)
- roster: VMSIG_EV_ROSTER + CAP_ROSTER, retained per-endpoint and replayed to late subscribers
- discovery: inotify trigger dir, vmid/endpoint slot allocator, host probe; vmsigd daemon with config + per-uid admission
- input driver and vgpu perception built in-tree; vgpu perception as a separate library
- memctx: own the supplied ro_fd (closed at detach)
- deb packaging: install rules, systemd unit, tmpfiles, default config

include/vmsig_control.h

@@ -37,6 +37,9 @@ typedef struct {
 #define VMSIG_CAP_MEMWRITE  0x100u /* CMD_MEMWRITE: atomic write-signaled mutation of shared guest memory
                                     * (separate from the freed CAP_MEMREAD bit — read != write; fresh bit
                                     * avoids stale-grant aliasing to this privileged cap). */
+#define VMSIG_CAP_ROSTER    0x200u /* SUBSCRIPTION to the VM roster (UP VMSIG_EV_ROSTER): which VMs occupy
+                                    * which endpoints, by name/state. Distinct from CAP_OBSERVE — this is
+                                    * host-wide inventory enumeration, not observing one VM's content. */
 
 typedef struct {
     uint32_t principal;      /* id for auditing (uid/token)                     */