x86_64: boot Asterinas as a non-root guest, with isolation test tooling

[sandst08much]

This adds the ability to boot Asterinas as a non-root guest zone, and a
tooling suite to actually check hvisor's isolation guarantees hold when a
guest zone is buggy or hostile, rather than just assuming they do.

Guest support:

• cpuid.rs / boot.rs: restructured CPUID/feature-flag handling;
  module_init() now supports multiple ordered boot modules (Asterinas
  ships as several separate modules, unlike Linux's single-image boot).
• ioapic.rs / pio.rs / trap.rs: non-root zones no longer get access
  to the real i8042/legacy ports or unrestricted IRQ ownership — those
  stay with zone 0.

Isolation tooling (tools/secure-isolation/):

• zonelint — validates a zone config against the same invariants the
  zone-memory-validation PR (submitted separately) enforces at runtime, so
  a bad config gets caught before you even try to boot it.
• virtio-fuzzer — throws malformed VirtIO descriptors at a guest to check
  the host doesn't choke on them.
• C fault-probe binaries plus fixtures modeling a specific attack scenario
  (a "victim" zone and an adjacent zone trying to reach into it).
• scripts/reproduce.sh — an 8-check harness tying all of the above
  together, plus a README and threat-model writeup describing exactly what
  is being defended against, and what isn't.

Depends on four smaller fixes submitted separately (fault containment,
LA57 MMIO handling, zone memory validation, the clippy fixes) — this
feature's own tests exercise all four, so this PR isn't correct to merge
without them also landing.

Verification: make ARCH=x86_64 BOARD=qemu MODE=release all,
cargo fmt --all -- --check — clean.
tools/secure-isolation/scripts/reproduce.sh: 8/8 passing (zonelint unit
tests, positive and negative zone-config validation, virtio-fuzzer unit
tests plus a dry-run pass, faultinj probe builds).