fix: cap SocketTable size and clear on restore

[danbugs]

Summary

• Caps SocketTable at 1024 entries (MAX_SOCKETS) — insert() now returns Result<u64> and errors when full, preventing unbounded host fd exhaustion from a malicious guest
• Adds SocketTable::clear() which drains all sockets and resets next_id
• Threads the Arc<Mutex<SocketTable>> through Sandbox so restore() can clear it — fixes host-side fd leak across guest restore cycles (the guest "forgets" its sockets on memory rewind, but the host-side table previously retained them)
• All construction paths covered: evolve_inline, evolve_mapped, from_snapshot_file_full

Test plan

• cargo test --lib net_socket_cap — verifies error at MAX_SOCKETS+1
• cargo test --lib socket_table_clear — verifies clear empties table and resets next_id
• Full cargo test --lib (50 tests) passes
• cargo fmt and cargo clippy clean

[github-actions]

Linux Benchmarks

Details

Benchmark suite	Current: 56f8710	Previous: a4831d7	Ratio
hello_world (median)	20 ms	20 ms	1
pandas (median)	110 ms	110 ms	1
density (per VM)	7 MB	7 MB	1
snapshot (disk)	385 MiB	385 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Windows Benchmarks

Details

Benchmark suite	Current: 56f8710	Previous: a4831d7	Ratio
hello_world (median)	243 ms	255 ms	0.95
pandas (median)	844 ms	829 ms	1.02
density (per VM)	6 MB	6 MB	1
snapshot (disk)	392 MiB	392 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.