vmsig: management daemon, runtime endpoint lifecycle, roster, discovery, in-tree drivers, packaging

- core: runtime attach/detach of a per-endpoint adapter trio (runtime-safe add_adapter + vmsig_core_detach_endpoint, deferred reap)
- roster: VMSIG_EV_ROSTER + CAP_ROSTER, retained per-endpoint and replayed to late subscribers
- discovery: inotify trigger dir, vmid/endpoint slot allocator, host probe; vmsigd daemon with config + per-uid admission
- input driver and vgpu perception built in-tree; vgpu perception as a separate library
- memctx: own the supplied ro_fd (closed at detach)
- deb packaging: install rules, systemd unit, tmpfiles, default config

include/vmsig_core.h

@@ -51,10 +51,20 @@ void        vmsig_core_set_arb_policy(vmsig_core* c, vmsig_arb_policy cb, void*
 
 /* Register an adapter for VM `endpoint`: open(cfg,endpoint) -> attach(...),
  * enroll each yielded fd into epoll and into the dispatch table fd->(adapter,cookie).
- * Returns the adapter id (>=0) or -1. */
+ * Returns the adapter id (>=0) or -1. Runtime-safe: may be called AFTER vmsig_core_run
+ * has started, from a loop-thread callback (e.g. a discovery SLOT_SOURCE), to hot-plug
+ * a VM's adapters; a freed adapter slot is reused so churn does not exhaust the table. */
 int  vmsig_core_add_adapter(vmsig_core* c, const vmsig_adapter_ops* ops,
                             const void* cfg, uint32_t endpoint);
 
+/* Request runtime detach of EVERY adapter currently attached to `endpoint` (the whole
+ * VM trio). Deferred: the teardown (epoch settle + SEAM_DOWN + lease release + epoll DEL
+ * + ops->close) runs after the current event batch, like core_request_drop for controls.
+ * Safe to call from a loop-thread callback (e.g. inotify discovery). No-op if endpoint
+ * is not attached or >= 64. The composing of the trio at attach is the caller's job
+ * (3x add_adapter); detach is by endpoint so the caller needs no per-adapter ids. */
+void vmsig_core_detach_endpoint(vmsig_core* c, uint32_t endpoint);
+
 /* Attach a control endpoint (in-process or socket) with a GRANT (capability set).
  * grant == NULL => default-deny (poller inert). The core sees only the neutral
  * vtable + grant + (opt.) fd. Returns the control id (>=0) or -1. */