fix: pause VM before MMDS injection, resume after to ensure config is applied

- Load snapshot with ResumeVM: false so MMDS data can be written while VM is paused
- Call ResumeVM explicitly after configureMmds succeeds
- Skip PUT /mmds/config on restored VMs (Firecracker rejects it with 400)
- Strip JSON quotes from MMDS values with tr -d '"' in net-init script
- Add 169.254.169.2/32 link-local addr and flush eth0 before applying new IP

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

orchestrator/network.go

@@ -110,9 +110,12 @@ func configureMmds(ctx context.Context, sockPath, ip, gw, dns string) error {
 		return nil
 	}
 
-	// Store the network config the guest daemon will poll for.
-	// PUT /mmds/config (interface association) was already handled by the SDK
-	// via AllowMMDS: true on the NetworkInterface before the VM started.
+	// 1. MMDS configuration (version, network_interfaces binding, etc.) is
+	// persisted in the golden snapshot, so we don't need to configure it here.
+	// In fact, Firecracker will reject PUT /mmds/config with a 400 error
+	// on a restored VM, which previously caused this function to abort early.
+
+	// 2. Store the network config the guest daemon will poll for.
 	return doJSON(http.MethodPut, "/mmds", map[string]string{
 		"ip":  ip,
 		"gw":  gw,