refactor: multiple fixes

- Create unified Arch enum in utils.rs with methods for all naming conventions
- Replace 5 duplicate architecture mapping functions with single source of truth
- Add memory string validation for QEMU
- Add KVM capability verification via ioctl
- Fix TOCTOU race in resolv.conf writing using O_EXCL
- Extract magic numbers to named constants
- Use constants for stack size, buffer sizes, hostname entropy

src/namespace.rs

@@ -105,7 +105,7 @@ where
     }
 
     // Stack for the child process
-    let stack_size = 1024 * 1024;
+    let stack_size = crate::utils::CHILD_STACK_SIZE;
     let mut stack = vec![0u8; stack_size];
 
     // Wrap f in Option to allow taking it once inside the child closure
@@ -198,7 +198,7 @@ where
     // O_CLOEXEC (on successful exec), so this read always terminates.
     let child_error: Option<String> = unsafe {
         let mut error_bytes = Vec::new();
-        let mut tmp = [0u8; 4096];
+        let mut tmp = [0u8; crate::utils::ERROR_BUFFER_SIZE];
         loop {
             let n = libc::read(
                 error_read.raw(),
@@ -397,7 +397,9 @@ pub fn set_hostname(distro: &str) -> Result<()> {
     let mut state = hasher.finish();
 
     let chars = b"abcdefghijklmnopqrstuvwxyz0123456789";
-    let random_suffix: String = (0..6)
+    // Use HOSTNAME_SUFFIX_BITS for entropy (6 hex chars = 24 bits)
+    let suffix_len = (crate::utils::HOSTNAME_SUFFIX_BITS as f64).log2() as usize / 4;
+    let random_suffix: String = (0..suffix_len)
         .map(|_| {
             // Knuth multiplicative LCG — each step advances the full 64-bit state.
             state = state