feat(control): add RestartZone RPC

Add a RestartZone RPC to ControlService, with RestartZoneRequest carrying
the zone id and an empty RestartZoneReply, mirroring DestroyZone.

Restart lets a client tear a zone's runtime down and re-create it from its
stored spec, re-launching its workloads, instead of a manual destroy and
recreate. The daemon decides which states are restartable and refuses
control-plane-owned zones, so the request needs no fields beyond the zone
id.

Signed-off-by: Steven Noonan <steven@edera.dev>

Author: tycho

protect/control/v1/control.proto

@@ -27,6 +27,8 @@ service ControlService {
 
   rpc CreateZone(CreateZoneRequest) returns (CreateZoneReply);
   rpc DestroyZone(DestroyZoneRequest) returns (DestroyZoneReply);
+  rpc RestartZone(RestartZoneRequest) returns (RestartZoneReply);
+
   rpc SuspendZone(SuspendZoneRequest) returns (SuspendZoneReply);
   rpc ResumeZone(ResumeZoneRequest) returns (ResumeZoneReply);
   rpc ForkZone(ForkZoneRequest) returns (ForkZoneReply);
@@ -114,6 +116,18 @@ message DestroyZoneRequest {
 
 message DestroyZoneReply {}
 
+// Restart tears a zone's runtime down and re-creates it from its stored spec,
+// re-launching its workloads. Valid from Failed (retry a crashed/failed zone),
+// Ready, and Created (an explicit destroy-and-recreate); rejected while the
+// zone is mid-transition. The daemon determines validity and refuses
+// control-plane-owned (e.g. CRI/Kubernetes) zones, so no extra request fields
+// are needed here.
+message RestartZoneRequest {
+  string zone_id = 1;
+}
+
+message RestartZoneReply {}
+
 // Cooperatively suspends a running Edera zone. The guest is asked to quiesce its
 // devices and self-suspend; the zone stays resident in memory and can later be
 // resumed with `ResumeZoneRequest`.