feat(sdk): capture firecracker stdio via console_path

Firecracker pipes the guest serial console (ttyS0) to its own
stdout, and FirecrackerProcessBuilder::spawn was leaving stdio
on inherit — so kernel boot output landed wherever the parent's
stdout happened to go, and a closed parent pipe produced
`Failed the write to serial: BrokenPipe` spam in firecracker's
own log file.

Add four additive knobs to FirecrackerProcessBuilder:

- console_path(path): open the file in create+append mode at
  spawn time; use it for stdout and stderr (cloned fd) unless
  a per-channel override is set. Typical use: capturing the
  guest serial console into an instance-local log file.
- stdin(Stdio) / stdout(Stdio) / stderr(Stdio): raw Stdio
  overrides for callers that need finer control.

Resolution is "explicit per-channel override wins, then
console_path, then command default (inherit)". Factored into
`apply_stdio` so the matrix is testable without a live
firecracker binary.

fc-cli gains a --console-path flag on the firecracker backend;
the jailer backend rejects it for now (TODO near the jailer
builder spawn documents a follow-up).

Additive only — bump 0.3.0 -> 0.3.1.

Author: PeronGH