fix: make macOS start idempotent and repair VNC proxy

[czmDeRepository]

Problem

Lifecycle operations can overlap: a queued vm start may acquire the VM lock after another operation has already restarted QEMU. Launching a second QEMU then fails and can disturb an otherwise healthy guest.

Separately, the host-side VNC proxy may be missing while QEMU and its Unix VNC socket are still healthy, leaving the VM running but unreachable over VNC.

Fix

• treat vm start as idempotent when the recorded QEMU process identity is still valid
• preserve the running VM's current launch state instead of applying start flags to an already-running process
• recreate the VNC proxy when QEMU is healthy but the proxy is missing
• verify the proxy using the executable name and VM-specific Unix socket path

This intentionally does not add compatibility for deployment-specific wrapper process names.

Validation

• go test ./...

[CMGS]

solid fix — the per-vm sock match in stopVNCProxy closes a real pid-reuse mis-kill, and the adopt path stops a queued start from disturbing a healthy guest (whose launch-failure path would have killed the live vnc proxy). small items inline: comment budget + two test helpers that already exist in cocoon utils.

gates on 9a648ea: make lint (linux+darwin) 0 issues, asl ./... clean on both GOOS, go test ./... green.

[CMGS]

all five items landed, thanks. one new gate failure though: the structural layout check (asl ./..., both GOOS) rejects handler_test.go — a helper now sits between two test funcs. see inline; everything else (lint linux+darwin 0 issues, go test, vet) is green on 595ae88.

[CMGS]

layout rule for _test.go: every Test* first, helpers after the last one — this helper between two tests fails the structural gate on both GOOS.

but i'd drop it altogether: 25 lines of os.Stdout swapping to assert a hint string is brittle and past the test's job — the contract is 'no error + record unchanged', which the test already proves. if you want to keep the assertion anyway, move the helper below TestPrepareNetNoProvision (last test in the file).