feat(input): daemon sets up the host->guest input-linux bridge via QMP

The uinput devices the input adapter creates were never forwarded into the
guest: the input-linux bridge was external (manual monitor object_add), so it
was lost on every reconfigure and whenever the kernel-assigned device numbers
changed. Make the vmhost seam -- which already owns the VM's single QMP
connection -- add the input-linux objects itself on reaching READY (A=keyboard
+abs with grab_all, B=mouse) and object_del them on teardown. The input adapter
publishes the uinput evdev paths into a per-endpoint home; discovery attaches
input before vmhost so the paths are ready. No second QMP socket or connection.

Also move the mouse buttons (incl. middle) and the wheel onto device B, so B is
a complete relative mouse and A is keyboard+abs only.

Bump 0.3.8.

src/adapter/input/include/input.h

@@ -3,11 +3,18 @@
 
 /* Private config of the input adapter (vmctl, in-tree at src/si/input/). cfg==NULL or
  * stub!=0 => stub mode (ack without actuation). stub==0 opens vmctl_open() and actuates for
- * real. Injection is ALWAYS uinput (orphaned host uinput + external QEMU input-linux);
- * qmp_path is kept for the SERVICE path (power/lifecycle via vmctl QMP), not for injection. */
+ * real. Injection is ALWAYS uinput; the created evdev nodes are forwarded into the guest by an
+ * input-linux QMP object that the vmhost seam adds over its own connection (this adapter only
+ * publishes the evdev paths, it never touches QMP). qmp_path is kept for the SERVICE path
+ * (power/lifecycle via vmctl QMP), not for injection. */
 typedef struct {
     int         stub;
     const char* qmp_path;     /* for power/lifecycle (vmctl QMP); NOT input injection */
+    /* On a real attach the adapter writes the uinput evdev node paths here (>=64 bytes each)
+     * so the vmhost seam can bridge them via input-linux. NULL => not published; B is "" when
+     * there is no second device. Buffers belong to the caller and outlive the adapter. */
+    char*       out_evdev_a;
+    char*       out_evdev_b;
 } vmsig_input_cfg;
 
 /* Input event codes/contract are PUBLIC: vmsig_input / vmsig_input_kind in