sync: pull cocoon v0.5.1 updates (idle-TAP softirq fix + dep bump)

[CMGS]

Ports the applicable changes from cocoon (now v0.5.1) into cocoon-macos.

Closes #19.

Included

1. Bump cocoon v0.4.6 → v0.5.1 (f308eb0)
Picks up shared-package fixes cocoon-macos gets for free through its imports: flock poll 100ms→2ms (#114), store Update fsyncs off the flock hold (#126), /proc-scan tolerance for pids that vanish mid-scan (#129), per-NIC CNI teardown (#111). Adapts the two utils.ReflinkCopy call sites to its new SyncMode arg (utils.Sync, preserving the prior fsync).

2. Quiesce host NICs on stop/rm — port of cocoon #130 (00e2c3e, 4a2f113)
A stopped CNI VM keeps its netns/TAP for a fast restart, but the dead VMM leaves the TAP carrier-less while its veth stays up on the bridge; tc mirred redirect then fires against the down device per LAN broadcast, storming softirqs until the host soft-locks — a host-crash landmine for any stopped or rm'd CNI VM. Now Quiesce on stop and on rm (before Delete), Unquiesce on start.

cocoon's bridge backend no-ops Quiesce (bridge TAPs have no tc redirect), and QEMU opens the TAP with script=no and never touches its link, so --net tap|bridge toggles the host TAP directly via netlink.LinkSetUp/Down (host netns only — a CNI TAP is the provider's job). netlink was already an indirect dependency, promoted to direct.

Start ordering note (vs #19's proposed scope). #19 proposed unquiesce before launching QEMU and re-quiesce on launch failure. This PR unquiesces after a successful launch instead: unquiescing before QEMU opens the TAP would briefly recreate the exact carrier-less-TAP + veth-up condition the fix removes (a storm window on every start), whereas launching first means the TAP already has carrier when the veths come up, and a failed launch simply leaves the network quiesced (no rollback needed). Same end state (veths up iff the VM is running), without reopening the window.

3. Guard test for the stop/rm force→grace mapping (e5bd110)
Pins --force → immediate SIGKILL (grace 0), default → the ACPI grace window; mirrors cocoon f6ebebc.

Assessed and skipped (already satisfied / not applicable)

• symlink-proof volume checks (#101) — N/A: cocoon-macos has no external-volume attach; --data-disk only creates fresh qcow2s under the VM dir, so there is no external path to symlink-smuggle a managed root through.
• parallel Range download dedup — already done: cmd/image/oci.go already builds on utils.SplitRanges / utils.CopyRangeBody.
• List off-lock (#60) — already done: List reads records via ReadDir + loadRec with no per-VM lock, and saveRec is atomic (utils.AtomicWriteJSON), so lock-free reads are safe.
• CH / Firecracker / android / vsock / hibernate / erofs-specific changes — not applicable to the qemu + macOS backend.

Validation

go build, go vet, and go test are green on both GOOS=linux and GOOS=darwin. Reviewed with a reuse/simplification/efficiency/altitude pass; the netlink swap and the r.Netns gate on setTapLink came out of it.