Instrument fork admission timing

[sjmiller609]

Summary

Adds targeted tracing around fork admission so parallel fanout traces can show where time is spent before restore:

• traces metadata exact-name scans with file/scanned counts and static caller labels
• traces fork metadata save, lock wait, and lock hold time
• traces snapshot memory readiness and guest directory clone work for fork/snapshot paths
• applies the metadata name-exists tracing to snapshot fork name checks too

The spans intentionally avoid recording requested instance names.

Testing

• go test ./lib/instances -run 'TestForkInstanceFromStandby|TestForkInstanceFromStopped|TestGetInstance|TestListInstances|TestSnapshot' -count=1\n- go test ./lib/instances -run 'TestSaveForkMetadataSerializesNameAdmission|TestForkInstanceRejectsDuplicateNameForNonNetworkedSource|TestForkInstanceFromStandbyCancelsCompressionJobAndCopiesRawMemory|TestForkSnapshotFromCompressedSourceCopiesRawMemory' -count=1\n- go test ./lib/network -count=1\n\nNote: I did not run the full go test ./lib/instances package to completion locally; it entered longer integration-style tests, so I used the focused fork/query coverage above for this instrumentation-only patch.

---

Note

Low Risk
Observability-only: spans and context threading on existing fork admission paths, with no intended change to locking or name-check semantics.

Overview
Adds OpenTelemetry spans along fork admission so parallel fanout traces can show time spent before restore, without recording requested instance names.

Metadata name checks now take context and a static caller label (fork_precheck, fork_admission, snapshot_create). Exact-name scans emit spans with metadata file counts, how many files were scanned, and match outcome.

saveForkMetadata is split into spans for the overall save, mutex wait, and hold while admission re-checks names and persists metadata; errors are wired so spans finish with the returned error.

Fork/snapshot guest copy and prepareForkWithAliasReadLock gain parent spans plus startLifecycleStep children for snapshot memory readiness and directory clone work (including deferred Firecracker memory paths).

^{Reviewed by Cursor Bugbot for commit c8b9a0f. Bugbot is set up for automated code reviews on this repo. Configure here.}