feat(firecracker): persistent registry volume for the infra VM (Stage B, 6/n)

The infra VM's rootfs is ephemeral (rebuilt each boot), so the bottle
registry DB needs durable storage across restarts. Give the infra VM a
firecracker analogue of a docker volume: a host-side ext4 file attached as
a second virtio-block device (guest /dev/vdb), mounted at the control
plane's DB dir (/var/lib/bot-bottle, where host_db_path lives at
db/bot-bottle.db).

- firecracker_vm.boot/_config take an optional `data_drive` (a non-root,
  RW second drive).
- infra_vm creates the volume on first use (`mke2fs` an empty ext4 at
  <fc-cache>/infra/registry.ext4) and mounts /dev/vdb in the PID-1 init
  before the control plane starts. It's a plain ext4 file, so
  `sudo mount -o loop <path>` (VM stopped) inspects bot-bottle.db directly.

Verified on a KVM host: register a bottle, restart the infra VM (fresh
rootfs, same volume) — /dev/vdb re-mounts and the registry `db/` dir + a
marker file survive the restart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_firecracker_backend.py

@@ -334,6 +334,18 @@ class TestBootArgs(unittest.TestCase):
         self.assertEqual("/run/rootfs.ext4", cfg["drives"][0]["path_on_host"])
         self.assertFalse(cfg["drives"][0]["is_read_only"])
         self.assertEqual("bbfc0", cfg["network-interfaces"][0]["host_dev_name"])
+        self.assertEqual(1, len(cfg["drives"]))  # no data drive by default
+
+    def test_config_adds_data_drive(self):
+        cfg = cast(Any, firecracker_vm._config(
+            rootfs=Path("/run/rootfs.ext4"), tap="bbfc0",
+            guest_ip="100.64.0.1", host_ip="100.64.0.0", pubkey="k",
+            vcpus=2, mem_mib=2048, guest_mac="06:00:AC:10:00:02",
+            data_drive=Path("/run/registry.ext4"),
+        ))
+        self.assertEqual(2, len(cfg["drives"]))
+        self.assertFalse(cfg["drives"][1]["is_root_device"])
+        self.assertEqual("/run/registry.ext4", cfg["drives"][1]["path_on_host"])
 
 
 class TestBottleExecClose(unittest.TestCase):