Improve security and error handling for VM state and guest file operations; clarify permissions requirements in documentation.

uvm/state.py

@@ -98,6 +98,10 @@ class StateStore:
                 os.chmod(path, 0o600)
             with path.open(encoding="utf-8") as state_file:
                 raw = json.load(state_file)
+        except PermissionError as error:
+            raise StateError(
+                f"cannot access protected VM registry {path}. Run this command with sudo."
+            ) from error
         except (OSError, json.JSONDecodeError) as error:
             raise StateError(f"cannot read {path}: {error}") from error
         return State.from_dict(raw)