feat: isolate Herdr state per environment

[kacpersaw]

Summary

• Keep the common host configuration mount while overlaying /home/dev/.config/herdr with private per-instance storage.
• Create fresh Herdr state for new environments, clones, and imports.
• Validate and repair the isolated mount when starting existing environments.
• Remove per-instance Herdr state only after instance deletion succeeds or absence is explicitly confirmed.
• Safely strip and restore host-specific devices during export.

Why

Herdr stores live sockets, session metadata, logs, and plugin state under its configuration directory. Sharing that directory between concurrently running environments can cause socket collisions and cross-environment state corruption.

A nested per-instance mount preserves sharing for the rest of the host configuration while isolating Herdr's mutable runtime state.

Implementation

• Add centralized constants and path helpers for the Herdr mount and host-side storage.
• Create per-instance directories with mode 0700.
• Validate existing mount type, source, and target before reuse.
• Give clones and imports fresh state instead of inheriting the source environment's Herdr directory.
• Stop running environments before export device removal and restart them only after complete restoration.
• Leave an environment stopped if restoration fails, preventing fallback to the shared parent directory.
• Preserve host-side state when failed cleanup cannot confirm that the instance was removed.
• Document mount and lifecycle behavior.

Risks / edge cases

• Exporting a running environment temporarily stops it while host-specific devices are removed.
• A restoration failure intentionally leaves the environment stopped for safety.
• Existing environments receive or repair the isolated mount on their next start.
• Herdr configuration, plugins, sessions, and runtime state are independent per environment.

Testing

• Full Nim unit test suite passes.
• Release CLI build succeeds with Nim 2.2.6.
• git diff --check passes.
• Verified mount precedence and isolation across multiple environments.
• Verified unique per-instance sources and mode 0700 directories.
• Verified isolated state persists across an environment restart.
• Destructive repository integration tests were not run.