fix: pause VM before MMDS injection, resume after to ensure config is applied

- Load snapshot with ResumeVM: false so MMDS data can be written while VM is paused
- Call ResumeVM explicitly after configureMmds succeeds
- Skip PUT /mmds/config on restored VMs (Firecracker rejects it with 400)
- Strip JSON quotes from MMDS values with tr -d '"' in net-init script
- Add 169.254.169.2/32 link-local addr and flush eth0 before applying new IP

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

orchestrator/snapshot.go

@@ -30,7 +30,7 @@ func loadSnapshotWithNetworkOverride(ctx context.Context, sockPath, memPath, vms
 	payload := snapshotLoadRequest{
 		MemFilePath:  memPath,
 		SnapshotPath: vmstatePath,
-		ResumeVM:     true,
+		ResumeVM:     false, // Changed: We pause here so MMDS can be configured BEFORE Resume.
 		NetworkOverrides: []networkOverride{
 			{IfaceID: "1", HostDevName: tapName},
 		},