Bake qemu-guest-agent into all golden images

[ars1364]

Why

An instance without qemu-guest-agent cannot be rescued in place. When SSH on a
VM stopped accepting connections, every quick recovery path was unavailable:

• virsh qemu-agent-command — needs the agent
• openstack server set --password (then log in on the console) — needs the agent
• openstack server rescue — generally unavailable for volume-backed instances

What was left was: stop the instance, map its Ceph RBD root volume on a compute
node, mount it, edit the file offline, unmount, start. That works, and it is
written up in
docs/ssh-locked-out-offline-root-volume-recovery.md
— but it takes an outage and cluster-admin access to fix what would otherwise be
a one-line change.

With the agent present the same incident is a single command and no downtime.

Scope

• Inventory the images currently in Glance and record which already have the agent
• Install qemu-guest-agent in the golden images at build time, not via
  cloud-init at first boot (an agent that only appears after a successful
  boot is missing exactly when it is needed)
• Set hw_qemu_guest_agent=yes on each image so Nova attaches the virtio
  channel: openstack image set --property hw_qemu_guest_agent=yes <image>
• Confirm qemu-guest-agent.service is enabled in the image, not just installed
• Verify per image after upload: boot a throwaway instance and check
  virsh qemu-agent-command <domain> '{"execute":"guest-ping"}' responds,
  then that openstack server set --password works end to end
• Decide the policy for existing running instances — the agent can be
  installed live, but it needs the virtio channel, which needs a stop/start
• Add the property to whatever builds/uploads images so new ones inherit it

Notes

• The channel only appears at instance creation, so existing instances need a
  stop/start after the image property is set — worth batching into a maintenance
  window rather than doing per-VM.
• Verifying guest-ping is the check that matters; the package being installed
  proves nothing on its own if the channel is absent.