fix: invalid mapping normalization

[dobrac]

Note

Revamps header mapping normalization to be non-mutating, adds strict/soft validation with version gating, bumps metadata version to 3, and wires validation into sandbox and inspect tool.

• Storage/Header:
  • Normalization: Reimplement NormalizeMappings to return a new, non-mutating merged list using BuildMap.Copy(); merges only adjacent same-BuildId ranges.
  • Validation & Safety: Add NormalizeFixVersion and Header.IsNormalizeFixApplied(); enforce bounds/alignment and negative-length checks in GetShiftedMapping/getMapping with errors for v3+ and warnings for older headers.
  • Version: Bump metadataVersion to 3 in serialization.go.
  • Tests: Add comprehensive tests for NormalizeMappings edge cases.
• Orchestrator:
  • Sandbox snapshotting: After building memfile/rootfs headers, call header.ValidateMappings; fail for v3+, otherwise log warnings with build ID.
  • CLI (inspect-header): Run ValidateMappings on deserialized header and print warning if invalid.

^{Written by Cursor Bugbot for commit 9290e96. This will update automatically on new commits. Configure here.}

[ValentaTomas]

Waiting for resolution of hard/soft checks, but otherwise, LGTM.