Resume Firecracker filesystem resize on same-size retry

[hbrodin]

Summary

• Resume Firecracker disk growth when the image has already reached the requested size: run the existing protected fsck and resize operations even for an equal-size request.
• Compare exact image byte lengths before deciding whether to truncate or reject a shrink, and require a StoppedInstance at the rootfs resize entry point.
• Add ext4 capacity regressions through the public CLI, including a repaired-fsck retry, a completed no-op, and an unaligned shrink. Add a Firecracker VM integration phase for same-size retry.

Closes #540.

Validation

• cargo build --workspace
• cargo fmt -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace -- --test-threads=1 (umask 022, private TMPDIR)
• cargo deny --workspace check
• taplo format --check
• prek run on the staged diff
• bash tests/privileged-disk.sh on Linux with e2fsprogs 1.47.0 and passwordless sudo
• Deliberately restored the old equal-size early return; the host regression failed. Restored the fix and reran the host regression successfully.
• bash -n for both changed shell tests

The full Firecracker VM suite was not run because this host has no /dev/kvm. The Lima VM suite was not run because this host is Linux. The new Firecracker VM phase is therefore awaiting a real VM gate.

Security boundary

The change uses the existing privileged disk helper, which validates managed paths after sudo and passes the opened rootfs descriptor to fsck/resize2fs. It adds no new privileged operation, network access, or secret forwarding. The resize entry point now requires the backend's stopped-instance lock witness.