feat(qemu-acpi): model guest NUMA nodes without PXB expanders

[kvinwang]

Summary

Lets VmConfig.numa_nodes describe guest NUMA nodes without pxb-pcie expanders: SRAT plus CPU _PXM, all devices on the root bus. A QEMU wrapper (like the one that already reports extra_root_devices) can add such nodes and record them in .sys-config.json, and the KMS can verify the resulting RTMR0. The multi-PXB layout can't be modeled this way, because each expander's _CRS comes from firmware enumeration.

• NumaNodeConfig.pxb_bus becomes Option<u8> and is skipped when None.
• qemu-acpi accepts nodes where every node has an expander or none does. Mixed layouts are still rejected.
• dstack-mr measure --numa-nodes N.
• Both differential harnesses cover the new layout. Adds a golden fixture dumped from the pinned reference QEMU.

Compatibility

• Existing vm_configs parse and serialize byte for byte as before. RTMR0 and verifier cache keys don't change: dstack-mr measure on next and on this branch agrees for 8 legacy layouts (plain, GPUs, hugepages, 1/2/4 PXBs, extra root devices).
• An older KMS fails to parse a node without pxb_bus and refuses the CVM (fails closed).

Testing

• differential-random.py against the CI reference image, seed 0x1053, 200 random cases: 243/243 pass, 66 of them pxb-less.
• differential-qemu.sh with the pinned reference QEMU (dump-all-blobs patch), 10 compat versions × 6 topologies: 60/60 three-blob matches, including the new numa2-plain.
• Real TDX host: QEMU 8.2.2, dstack-0.6.0 image, 4 vCPU, 4 GiB, two pxb-less nodes plus one extra root endpoint, key provider none. The guest sees both nodes. dstack-mr diagnose reports MRTD, RTMR0-2 and the RTMR0 event log as MATCH. Without numa_nodes, RTMR0 mismatches.