chore: stabilize testing

[sjmiller609]

Note

Medium Risk
Touches core hypervisor binary extraction paths (adds locking + atomic install) and introduces CI prewarming that depends on a local Docker registry and shared cache directories; failures here could break builds/tests or cause flaky runtime startup on first boot.

Overview
Stabilizes and speeds up CI integration tests by adding a cmd/test-prewarm tool and wiring it into the GitHub Actions workflows to pre-mirror a small set of base images into a local registry and pre-generate system/hypervisor artifacts into a shared cache directory.

Tests are updated to consume the prewarmed cache (symlinking system/ content into each temp DataDir) and to pull images via integrationTestImageRef() when HYPEMAN_TEST_REGISTRY is set/strict, reducing Docker Hub rate-limit exposure.

Separately hardens test infrastructure: Linux parallel test networking now allocates/leases non-conflicting subnets with cross-process locking and cleanup of stale routes/iptables artifacts, and embedded hypervisor binary extraction (cloud-hypervisor + firecracker) is made concurrency-safe via locks and atomic temp-file renames (with a new Firecracker concurrent extraction test).

^{Written by Cursor Bugbot for commit 7fbf752. This will update automatically on new commits. Configure here.}

[sjmiller609]

minimal non-test coded added, taking liberty to merge

[cursor]

Risk assessment: Medium-High (review required, no self-approval)

Evidence from code diff (not PR description):

• Modifies shared runtime codepaths in lib/vmm/binaries_linux.go and lib/hypervisor/firecracker/binaries.go (binary extraction/install flow, locking, atomic rename behavior).
• Adds substantial new CI/test orchestration in .github/workflows/test.yml, cmd/test-prewarm/main.go, and lib/instances/test_network_config_test.go (local registry bootstrap, subnet lease persistence, route/iptables cleanup behavior).
• Large multi-file change set with behavioral effects (20 files, 1183 insertions), increasing regression surface across test/runtime setup.

Decision:

• Code review is required.
• Not approving at this stage under risk policy.
• Requested reviewers: @rgarcia, @hiroTamada.

---