cut: require cocoon v0.6.9, drop the snapshot-list banner guard; fix findVM's positional argument

[CMGS]

Summary

cocoon v0.6.9 (the first tag with cocoon #264) prints [] for snapshot list --format json on an empty store. sandboxd's SnapshotList kept a guard for the prose banner (No snapshots found.) older builds printed. This PR:

• raises RequiredCocoon to v0.6.9 and says so in docs/deploy.md;
• drops the banner guard, so SnapshotList parses whatever cocoon prints and reports a non-JSON reply as parse snapshot list;
• adds TestSnapshotListReadsAnEmptyStoreAndRejectsProse, which drives SnapshotList through a fake cocoon on PATH. With the guard put back, the prose case fails, so the test pins the cut.

With a cocoon below v0.6.9 and an empty store, the startup reconcile logs snapshot sweep skipped and adopts journaled hibernate intents as before (reconcile.go treats a list error that way), and a pending-snapshot resolve returns an error that the caller retries. The startup version warning names the floor. The store is empty only before the first golden, so a node past its first pool build never hits the path.

A defect this found: findVM never worked against cocoon v0.6.6 or newer

findVM passed the VM name to cocoon vm list as a positional argument and then filtered the list itself. cocoon #237 (in v0.6.6) made vm list cobra.NoArgs, so every call since has failed with unknown command "<vm>" for "cocoon vm list". Four paths degrade on it: vsockOf after a create whose record lacks the socket, tapOf on the egress lane, the resident-memory stat, and confirmGone, which then records a removed VM as survived removal. The second commit lists without the argument (List loses its variadic filter, so no caller can bring it back), and TestListPassesNoPositionalArgsToCocoon drives List through a fake cocoon that rejects a positional argument the way cobra does.

Review

• Style self-check on every touched file: one const block at the top, tests before helpers, zero comments in the test.
• Comment lines −2/+1 (the guard's comment goes; RequiredCocoon's one-line doc now names both things the floor carries).
• Size: prod +7/−13, tests +38/−9, docs +6/−5; comment lines +2/−3.

Gates

GATES_PLACEHOLDER

Hardware (host A, linux/amd64)

• cocoon v0.6.9 release binary (sha256 873b07eb…) on a fresh isolated root: snapshot list --format json prints [], exit 0; vm list --format json prints [].
• The cut build against cocoon v0.6.9 on an isolated root: the startup reconcile on an empty data dir logs adopted 0 claims, 0 VMs live and golden ready, 0 snapshot sweep skipped warnings, 0 warn/error lines; scripts/sandboxd-e2e.sh (golden, warm pool, claim tiers, SDK smoke, reap, restart) exits 0 with no VM left in the root.
• confirmGone A/B, each arm: claim, remove the VM behind sandboxd's back, release.
  • cut only: release 500; log has unknown command twice, verify remove of twice and one survived removal.
  • cut + fix: release 204; none of those lines.