fix(cni): quiesce host NICs on stop to end the idle-TAP softirq storm

[CMGS]

Problem

A stopped CNI VM keeps its per-VM netns and TAP so vm start can reuse them, but stopping the VM kills the VMM, which drops the TAP's carrier. The CNI veth (eth0) stays UP on the host bridge (cni0) receiving LAN broadcast, and the tc mirred ingress redirect (eth0 → TAP, from tcRedirectInNS) fires against the now-down TAP for every packet:

tc mirred to Houston: device tapXXXXXXXX-0 is down

Under a bridge carrying a physical uplink this storms softirqs (NOHZ tick-stop, pending TASKLET/RCU) until the host soft-locks and reboots. The netns/TAP/tc were only torn down on vm rm, never on stop — so any stopped CNI VM was a host-crash landmine. Reproduced on hardware with a plain Ubuntu VM (not a workload): after vm stop it stormed dmesg with thousands of these messages and rebooted the host.

Fix

Add Quiesce/Unquiesce to the network.Network interface:

• CNI — bring every recorded veth (ethN) down/up inside the netns. Downing eth0 stops cni0 from forwarding LAN broadcast into the netns, so the redirect never targets a carrier-less TAP. The netns and TAP are kept for the fast restart.
• Bridge — no-op: bridge TAPs sit directly on the host bridge with no tc redirect to storm.

Wired symmetrically with the existing lifecycle: vm stop quiesces after hyper.Stop (counterpart to vm rm's netProvider.Delete); vm start's recoverNetwork unquiesces on the fast-restart (Verify-passes) path.

Verification (hardware)

Phase	eth0	Evidence
running	UP	normal
after vm stop	DOWN	quiesce applied
8s stopped, under LAN broadcast	—	mirred messages: 1 (was thousands)
after vm start	UP	unquiesce applied
after restart	—	VM re-acquired its DHCP IP; host stable

Build + vet + golangci-lint clean on linux and darwin. Unit tests added for CNI Quiesce/Unquiesce (toggles every NIC; skips a VM with no records).