feat(snapshot): add full checkpoint capture and restore

[appcypher]

TL;DR

Capture a running sandbox as a full snapshot and restore its disk, memory, execution, device, and runtime filesystem state. The same artifact can also be restored disk-only for an ordinary cold boot.

Description

• Add full snapshot capture for running sandboxes, with guest workload quiescing, same-epoch runtime checkpoint publication, and explicit source resume.
• Restore full snapshots eagerly into child-owned disk and runtime state, gate workload and network activation on freshness, and keep the source artifact independent after construction.
• Stream full snapshots directly to archives without installing an intermediate snapshot directory or index row, and verify the complete checkpoint closure before restore.
• Add disk-only restore for installed and archived full snapshots, producing a fresh writable qcow2 head while discarding captured memory and execution state.
• Expose the behavior consistently through the CLI and Rust, Python, TypeScript, and Go SDKs, including warnings when a command is ignored during full restore.
• Capture and restore passthrough filesystem handles and directory iteration state on Unix and Windows, and report unsupported checkpoint capabilities explicitly.

msb snapshot create worker-checkpoint --from worker --full
msb run --name worker-copy --from-snapshot worker-checkpoint
msb run --name worker-cold --from-snapshot worker-checkpoint --disk-only

let snapshot = Snapshot::builder("worker-checkpoint")
    .from_sandbox("worker")
    .full()
    .create()
    .await?;

let sandbox = Sandbox::builder("worker-cold")
    .from_snapshot("worker-checkpoint")
    .disk_only()
    .create()
    .await?;

snapshot = await Snapshot.create(
    "worker-checkpoint",
    from_sandbox="worker",
    full=True,
)

sandbox = await Sandbox.create(
    "worker-cold",
    from_snapshot="worker-checkpoint",
    disk_only=True,
)

const snapshot = await Snapshot.builder("worker-checkpoint")
  .fromSandbox("worker")
  .full()
  .create();

const sandbox = await Sandbox.builder("worker-cold")
  .fromSnapshot("worker-checkpoint")
  .diskOnly()
  .create();

snapshot, err := m.Snapshot.Create(ctx, m.SnapshotCreateOptions{
    Name:        "worker-checkpoint",
    FromSandbox: "worker",
    Full:        true,
})

sandbox, err := m.CreateSandbox(ctx, "worker-cold",
    m.WithFromSnapshot("worker-checkpoint"),
    m.WithSnapshotDiskOnly(),
)

Test Plan

• cargo fmt --all -- --check passes
• Filesystem, runtime, and Rust SDK test suites pass against the stacked libkrun checkpoint substrate
• Python, TypeScript, and Go SDK build, lint, type, unit, and live smoke checks pass
• Full, direct-archive, and disk-only variants pass live on macOS AArch64 with HVF
• Full, direct-archive, and disk-only variants pass live on Linux x86-64 with KVM
• Full, direct-archive, and disk-only variants pass live on Windows AArch64 with WHP (Surface unavailable; final rerun pending)

Closes #250

[greptile-apps]

Sequence Diagram

sequenceDiagram
  participant C as CLI / SDK
  participant S as Source sandbox
  participant A as Guest agent
  participant R as Runtime
  participant V as VM
  participant P as Snapshot publisher
  participant D as Restored sandbox
  C->>R: Create full snapshot
  R->>A: Freeze workload
  A-->>R: Workload frozen
  R->>V: Pause VM and capture state
  R->>P: Publish checkpoint closure root-last
  R->>V: Resume source VM
  R->>A: Thaw workload
  P-->>C: Full snapshot artifact
  C->>D: Restore full or disk-only
  D->>P: Verify descriptor and closure
  alt Full restore
    D->>D: Materialize disk, memory, device, and runtime state
    D->>V: Resume captured execution
  else Disk-only restore
    D->>D: Copy sealed disk layers and create writable qcow2 head
    D->>V: Cold boot
  end

Loading

Prompt To Fix All With AI

### Issue 1
sdk/rust/lib/sandbox/modify.rs:802-810
**Quiesced source reported successful**

When VM resume or workload thaw fails after checkpoint publication, this branch returns `Ok(checkpoint)` even though the runtime has transitioned to `Quiesced`. The source remains reported as running but cannot execute normally or accept later checkpoint, CPU, memory, or secret mutations, and the control API provides no operation to resume or thaw it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(snapshot): detach deferred full rest..." | Re-trigger Greptile}

[greptile-apps]

Quiesced source reported successful

When VM resume or workload thaw fails after checkpoint publication, this branch returns Ok(checkpoint) even though the runtime has transitioned to Quiesced. The source remains reported as running but cannot execute normally or accept later checkpoint, CPU, memory, or secret mutations, and the control API provides no operation to resume or thaw it.

Knowledge Base Used: Runtime execution orchestration

Prompt To Fix With AI

This is a comment left during a code review.
Path: sdk/rust/lib/sandbox/modify.rs
Line: 802-810

Comment:
**Quiesced source reported successful**

When VM resume or workload thaw fails after checkpoint publication, this branch returns `Ok(checkpoint)` even though the runtime has transitioned to `Quiesced`. The source remains reported as running but cannot execute normally or accept later checkpoint, CPU, memory, or secret mutations, and the control API provides no operation to resume or thaw it.

**Knowledge Base Used:** [Runtime execution orchestration](https://app.greptile.com/microsandbox/-/custom-context/knowledge-base/superradcompany/microsandbox/-/docs/runtime-execution.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Too many files changed for review (135 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

[appcypher]

Implemented explicit sealed-prefix compaction and incremental layer exports in ed4167f, stacked directly on the existing PR tip (no newer main). CLI and Rust/Python/TypeScript/Go interfaces include compaction, since/last-layer selection, explicit-base load, and direct archive restore.

Live qualification: managed/flat running and stopped workflows pass on macOS/HVF, Linux/KVM, and Windows/WHP. macOS and Linux main matrices each passed 108 checks. Deep-chain 65 → 34 → 2 tests pass on both layouts on macOS/Linux and managed Windows, including restart and old-snapshot preservation. Windows flat-depth completion is unconfirmed after SSH became unreachable. Native language SDK workflows and cancellation/start races were live-tested on macOS.

Short-chain VM pause samples (managed / flat): macOS 16.1 / 15.1 ms, Linux 2.20 / 2.28 ms, Windows 5.25 / 4.58 ms. These are measured samples, not latency guarantees.

Full coverage, performance, reproduction scripts, and remaining qualification. Exhaustive power-loss/ENOSPC injection and the full SDK × OS matrix are not claimed complete.