vmsig: management daemon, runtime endpoint lifecycle, roster, discovery, in-tree drivers, packaging

- core: runtime attach/detach of a per-endpoint adapter trio (runtime-safe add_adapter + vmsig_core_detach_endpoint, deferred reap)
- roster: VMSIG_EV_ROSTER + CAP_ROSTER, retained per-endpoint and replayed to late subscribers
- discovery: inotify trigger dir, vmid/endpoint slot allocator, host probe; vmsigd daemon with config + per-uid admission
- input driver and vgpu perception built in-tree; vgpu perception as a separate library
- memctx: own the supplied ro_fd (closed at detach)
- deb packaging: install rules, systemd unit, tmpfiles, default config

include/vmsig_roster.h

@@ -0,0 +1,40 @@
+#ifndef VMSIG_ROSTER_H
+#define VMSIG_ROSTER_H
+#include <stdint.h>
+
+/* vmsig_roster.h — NEUTRAL inventory-coherence contract.
+ *
+ * The signaling daemon owns the discovery namespace and assigns each running VM a stable
+ * ENDPOINT slot [0,64). The roster is the per-endpoint datum "which VM currently occupies
+ * this slot, by what name, in what coarse lifecycle state". It is published as an UP event
+ * VMSIG_EV_ROSTER (source=CORE), retained per endpoint and replayed to a late subscriber —
+ * exactly like the MEMCTX datum, but carrying identity rather than an address-space handle.
+ *
+ * This is COHERENCE of shared state (the endpoint roster is shared across all controls),
+ * NOT perception and NOT access-brokering. A consumer decodes it WITHOUT any host/Proxmox
+ * knowledge: `endpoint` rides in the event header (ev->endpoint), the rest in inln[48].
+ * CAP_ROSTER gates RECEIVING the datum (subscription), not access — access stays OS-DAC. */
+
+/* Roster transition (entry->action). */
+enum {
+    VMSIG_ROSTER_ATTACH = 0,   /* endpoint is now occupied by `vmid`                 */
+    VMSIG_ROSTER_DETACH = 1,   /* endpoint vacated (the slot bit is being released)  */
+    VMSIG_ROSTER_UPDATE = 2    /* same vmid on the slot; state and/or name changed    */
+};
+
+/* roster->flags bits */
+#define VMSIG_ROSTER_NAME_TRUNC 0x1u   /* the VM name did not fit and was truncated   */
+
+#define VMSIG_ROSTER_NAME_MAX 32       /* inline, NUL-terminated, truncated name      */
+
+/* The roster datum, carried inline (inln[48]). `endpoint` is NOT here — it is the event
+ * header's ev->endpoint (where every event carries it, and what the wire serializes). */
+typedef struct {
+    uint32_t vmid;     /* host VM id (e.g. Proxmox vmid 100..1e9) — does NOT fit endpoint */
+    uint32_t state;    /* coarse lifecycle: VMSIG_VM_* (vmsig_event.h), from the host plane */
+    uint32_t action;   /* VMSIG_ROSTER_ATTACH/DETACH/UPDATE                              */
+    uint32_t flags;    /* VMSIG_ROSTER_* (e.g. NAME_TRUNC)                                */
+    char     name[VMSIG_ROSTER_NAME_MAX]; /* NUL-terminated, truncated display name      */
+} vmsig_roster;        /* 4+4+4+4+32 = 48 — exactly inln[48]                              */
+
+#endif /* VMSIG_ROSTER_H */