fix(fleet): /dev/kvm present is not /dev/kvm usable

The capability probe reported `kvm: false` on tank and morpheus while the
device sat right there: /dev/kvm is `crw-rw---- root:kvm` and the kvm
group was EMPTY, so the daemon — an ordinary user — could not open it.
The B0 spike missed this entirely because it ran everything under sudo.

This is exactly why the probe opens the device rather than stat-ing it;
a stat-based check would have reported both nodes capable and every
microvm mission would have failed at launch instead of at placement.

fc-node-setup.sh now fixes the group itself, or says precisely what to
run when it cannot.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/fc-node-setup.sh

@@ -42,6 +42,21 @@ for host in "$@"; do
   fi
   pass "$host" "/dev/kvm present"
 
+  # Present is not the same as usable. /dev/kvm is `crw-rw---- root:kvm`, and
+  # the node daemon runs as an ordinary user — on tank and morpheus the kvm
+  # group was EMPTY, so the daemon reported `kvm: false` while the device sat
+  # right there. The B0 spike missed it entirely because it ran under sudo.
+  # This is why the capability probe opens the device instead of stat-ing it.
+  if ! ssh "$host" 'test -r /dev/kvm && test -w /dev/kvm' 2>/dev/null; then
+    if ssh "$host" 'sudo -n usermod -aG kvm $(id -un) && sudo -n systemctl restart clawmates-node' 2>/dev/null; then
+      pass "$host" "added $(ssh "$host" 'id -un') to the kvm group (daemon restarted)"
+    else
+      fail "$host" "/dev/kvm is not readable/writable by the daemon user and could not be fixed — run: sudo usermod -aG kvm <user> && sudo systemctl restart clawmates-node"
+    fi
+  else
+    pass "$host" "/dev/kvm is openable by the daemon user"
+  fi
+
   # 2. Install, verifying the checksum by hand.
   #
   # `sha256sum -c` against the published file compares by FILENAME, so saving