fix(core): add libvirt patch for USB startupPolicy in containers

[yaroslavborbat]

Description

Add a libvirt patch (005-usb-startup-policy-in-containers.patch) that fixes startupPolicy='optional' for USB hostdev in containerized environments.

The patch adds a virFileExists check on the device node path in virUSBDeviceSearch after sysfs discovery. If the /dev/bus/usb/ node is missing, the device is skipped so that callers see an empty result and handle the absence gracefully.

See also:

• set required startup policy for usb hotplug 3p-kubevirt#124
• https://github.com/containerd/containerd/blob/c8802b6e7b81b21ffc134a9c1028f472f87dc262/pkg/oci/mounts.go#L58

Why do we need it, and what problem does it solve?

In containers, sysfs (/sys/bus/usb/devices/) is mounted from the host kernel and exposes all USB devices regardless of mount namespace isolation. This causes libvirt's virUSBDeviceSearch to report a device as available even when the corresponding /dev/bus/usb/ node is not present in the container's mount namespace.

As a result, startupPolicy='optional' does not remove the missing USB hostdev from the domain XML during incoming migration, and QEMU fails to start with:

Could not open '/dev/bus/usb/005/002': No such file or directory

This breaks VM live migration when USB devices are attached via hotplug and the target node does not yet have the device node mounted into the virt-launcher pod.

What is the expected result?

1. Start a VM with a hotplugged USB device on node A.
2. Migrate the VM to node B where the USB device node is not yet in the pod's mount namespace.
3. The migration succeeds — libvirt skips the missing USB hostdev due to startupPolicy='optional'.
4. After migration, the USB device is hotplugged into the VM on the target node.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: fix
summary: Fix USB startupPolicy='optional' in containers where sysfs exposes host devices but device nodes are absent from the mount namespace.
impact_level: low