vmsig: management daemon, runtime endpoint lifecycle, roster, discovery, in-tree drivers, packaging

- core: runtime attach/detach of a per-endpoint adapter trio (runtime-safe add_adapter + vmsig_core_detach_endpoint, deferred reap)
- roster: VMSIG_EV_ROSTER + CAP_ROSTER, retained per-endpoint and replayed to late subscribers
- discovery: inotify trigger dir, vmid/endpoint slot allocator, host probe; vmsigd daemon with config + per-uid admission
- input driver and vgpu perception built in-tree; vgpu perception as a separate library
- memctx: own the supplied ro_fd (closed at detach)
- deb packaging: install rules, systemd unit, tmpfiles, default config

packaging/deb/postinst

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+case "$1" in
+configure)
+    ldconfig || true
+    mkdir -p /etc/vmsig
+    chmod 0640 /etc/vmsig/vmsigd.conf 2>/dev/null || true   # carries the uid->grant policy
+    mkdir -p /dev/shm/vmsig && chmod 0755 /dev/shm/vmsig     # also (re)created at boot via tmpfiles
+    if [ -d /run/systemd/system ]; then
+        systemctl daemon-reload || true
+        systemd-tmpfiles --create /usr/lib/tmpfiles.d/vmsig.conf || true
+        systemctl enable vmsigd.service || true              # enable, but do NOT start
+    fi
+    echo "vmsig: review the [grant] policy in /etc/vmsig/vmsigd.conf, then: systemctl start vmsigd" >&2
+    ;;
+abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+esac
+exit 0