Enhance documentation and validation for VM lifecycle and network management; add tests for legacy cleanup and address validation.

uvm/lifecycle.py

@@ -104,6 +104,10 @@ class LifecycleService:
                    for network in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")):
             raise ValidationError("private ports require a network inside an RFC 1918 IPv4 range")
         check_kvm()
+        self._verify_firecracker()
+        self._network.firewall.check_available()
+
+    def _verify_firecracker(self) -> None:
         manifest = load_manifest(self._settings.integrity_manifest_path)
         checksum = self._settings.firecracker_binary_sha256
         if manifest.verified or self._settings.allow_unverified_downloads:
@@ -111,7 +115,6 @@ class LifecycleService:
         verify_file(self._settings.firecracker_binary, checksum, "Firecracker binary",
                     "UVM_FIRECRACKER_BINARY_SHA256",
                     allow_unverified=self._settings.allow_unverified_downloads)
-        self._network.firewall.check_available()
 
     def _boot(self, vm: VmRecord, kernel: Path) -> None:
         vm.status, vm.operation = "starting", "network"
@@ -414,6 +417,7 @@ class LifecycleService:
 
     def diagnostics(self) -> list[dict]:
         checks = [("root", require_root), ("kvm", check_kvm),
+                  ("Firecracker", self._verify_firecracker),
                   ("guest assets", self._images.installed_assets),
                   ("private firewall", self._network.firewall.check_available)]
         results = []