fix(vmm): preserve orphan VM workdir when no .removing marker

Only delete the VM workdir during cleanup if the .removing marker file
is present (set by user-initiated remove_vm). Orphaned supervisor
processes discovered at startup without the marker now have their
workdir preserved, preventing accidental data loss on VMM restart.

Author: kvinwang

vmm/src/app.rs

@@ -351,12 +351,17 @@ impl App {
             }
         }
 
-        // Delete the workdir (may already be gone, e.g. manual deletion before reload)
+        // Only delete the workdir if the .removing marker is present (user-initiated removal).
+        // Orphaned supervisor processes without the marker keep their data intact.
         let vm_path = self.work_dir(id);
-        if vm_path.path().exists() {
-            if let Err(err) = fs::remove_dir_all(&vm_path) {
-                error!("Failed to remove VM directory for {id}: {err:?}");
+        if vm_path.is_removing() {
+            if vm_path.path().exists() {
+                if let Err(err) = fs::remove_dir_all(&vm_path) {
+                    error!("failed to remove VM directory for {id}: {err:?}");
+                }
             }
+        } else if vm_path.path().exists() {
+            info!("VM {id} workdir preserved (no .removing marker): {}", vm_path.path().display());
         }
 
         // Free CID and remove from memory (last step)