chore: update proto, scripts, and docs for CH migration

- Update hostagent proto: firecracker_version → vmm_version in metadata
- Regenerate hostagent.pb.go
- Update .env.example: WRENN_FIRECRACKER_BIN → WRENN_CH_BIN
- Update Makefile: remove --isnotfc from dev-envd target
- Update prepare-wrenn-user.sh: firecracker → cloud-hypervisor paths
  and capability assignments
- Update wrenn-init.sh: disable write_zeroes on rootfs for dm-snapshot
  compatibility with CH
- Update README.md and CLAUDE.md: Firecracker → Cloud Hypervisor
  throughout

images/wrenn-init.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# wrenn-init: minimal PID 1 init for Firecracker microVMs.
+# wrenn-init: minimal PID 1 init for Cloud Hypervisor microVMs.
 # Mounts virtual filesystems, starts chronyd for time sync, then execs tini + envd.
 
 set -e
@@ -17,6 +17,11 @@ mkdir -p /sys/fs/cgroup
 mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null || true
 echo "+cpu +memory +io" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || true
 
+# Disable write_zeroes on rootfs — dm-snapshot doesn't support BLKZEROOUT,
+# and CH advertises the feature anyway. Without this, every zeroing IO
+# hits EOPNOTSUPP and CH spams warnings. Only writable on kernel 6.6+.
+echo 0 > /sys/block/vda/queue/write_zeroes_max_bytes 2>/dev/null || true
+
 # Set hostname and make it resolvable (sudo requires this).
 hostname capsule
 echo "127.0.0.1 capsule" >> /etc/hosts