feat(cli): ecrou provision bakes a command into a cache entry

prepare_provisioned and persist were sitting there with no consumer:
the machinery for "install once, every later boot carries it" that
one-shot machines cannot do on their own - packages, users, anything
short of a share - and no way to reach it.

ecrou provision IMAGE -- COMMAND is the missing surface. It boots a
machine over a freshly prepared rootfs, runs the command, and
persists the tree into the cache entry, marked provisioned; a marked
entry is extracted as-is on every later call, the command skipped.
A failing command leaves the entry unprovisioned for the next
attempt, and --no-cache re-downloads before re-provisioning.

The engine behind run splits out as vm::run_prepared: the boot half
of run, taking the rootfs the provisioner is about to persist. run
itself is prepare plus that.

One cache fix the provision flow surfaced: a digest refresh replaced
the tarball but left the old .provisioned marker, so a fresh pristine
image would present as provisioned and skip provisioning for good.
The marker now dies with the entry it belonged to.

crates/ecrou-cli/src/cli.rs

@@ -21,6 +21,23 @@ pub struct Cli {
 pub enum Command {
     /// Run a command in a fresh microVM from an image
     Run(RunArgs),
+    /// Bake a command into an image's cache entry: the command runs in
+    /// a machine over a freshly prepared rootfs, and the result is
+    /// persisted, so every later boot of the image carries what the
+    /// command installed. Cached entries are reused as-is; --no-cache
+    /// re-downloads and re-provisions.
+    Provision {
+        /// Distribution name or OCI image reference
+        image: String,
+        /// Ignore the cache and download a fresh image
+        #[arg(long)]
+        no_cache: bool,
+        /// The provisioning command. An argument vector after `--` is
+        /// taken literally; a single quoted line runs through the
+        /// image's shell.
+        #[arg(last = true)]
+        command: Vec<String>,
+    },
     /// Report what a run would find on this host
     Probe,
 }