feat: enhance network management and lifecycle handling with improved egress setup and validation

uvm/lifecycle.py

@@ -177,7 +177,10 @@ class LifecycleService:
                 raise ConflictError(f"resize is pending for {vm.id}; retry resize or stop it before starting")
             if vm.status != "running" or vm.operation not in {None, "policy"}:
                 raise ConflictError(f"{vm.id} has an interrupted boot/stop; stop it before starting")
-            return self._sync_ports_locked(vm)
+            self._validate_retained_network(vm)
+            vm = self._sync_ports_locked(vm)
+            self._network.ensure_bridge()
+            return vm
         self._validate_resume(vm)
         if kernel is None:
             self._check_boot()
@@ -276,6 +279,9 @@ class LifecycleService:
         disk = Path(vm.disk)
         if not vm.disk or not disk.is_file() or disk.is_symlink() or disk.stat().st_nlink != 1:
             raise UvmError(f"private VM disk is missing or unsafe: {disk}")
+        self._validate_retained_network(vm)
+
+    def _validate_retained_network(self, vm: VmRecord) -> None:
         if (vm.gateway != str(self._settings.gateway)
                 or vm.network not in {None, str(self._settings.network)}
                 or vm.bridge not in {None, self._settings.bridge}):