Expose native guest timing and HPET legacy timer control

[Vbitz]

Summary

• Add read-only KVM guest TSC-frequency and stopped-VCPU MSR observations.
• Expose HPET legacy-replacement control through KVM PIT2 flags, preserving programmed channels and unrelated flags.
• Include PIT flags in inspection and add native KVM tests that verify timer restoration and observation without guest execution.

This is the low-level dependency for original Lion boot/desktop support in tinyrange/trex. All Darwin handoff, device models, format readers and recipe policy remain outside cc.

Validation

• go run ./internal/cmd/build-guestinit (documented prerequisite)
• GOWORK=off go test -short ./... -count=1 -timeout 30m
• GOWORK=off go vet ./...
• Focused native KVM timing/legacy-timer tests with /dev/kvm available.

Dependency order

Merge this PR first, then pin trex's cc submodule to its final merged commit; tinyrangex follows trex.

[Vbitz]

Downstream engine PR: tinyrange/trex#68. It pins cc to the final merge commit 69e22fb67f7a907428cc32093ed662081128a634; the fresh unattended Lion desktop and Calculator 2+2=4 smoke passed again against that pin.