Merge upstream main into vsock control-plane PR

[Copilot]

The vsock PR branch had diverged from main by two commits that added overlapping changes to types.py, api.py, and vm.py.

Summary

Resolved conflicts by incorporating all upstream changes while preserving vsock additions:

• types.py: Added extra_drives: list[Path], network_rate_limit_mbps, updated VM ID regex (now permits _), and validate_extra_drives/_validate_file_path validators alongside existing VsockConfig + vsock field.
• api.py: Merged rate_limit_mbps token-bucket logic into add_network_interface alongside existing add_vsock.
• vm.py: Added extra-drives attachment loop, rate_limit_mbps passthrough, and remove_egress_rules cleanup call alongside existing vsock provisioning.
• Non-conflicting files: Applied upstream changes to network.py, build.py, doctor.py, README.md, and all affected test files as-is.

Related Issues

Testing

• pytest tests/test_vsock.py tests/test_types.py tests/test_vm.py — 59 tests pass

Checklist

• Scope is focused and limited to this change
• Tests added/updated for behavior changes
• Docs updated for user-visible changes
• No secrets or sensitive data included

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.