Consolidate binaries; add 'stream' subcommand for direct-to-remote acquisition

[demoray]

Consolidate the four standalone binaries (avml, avml-convert, avml-upload, avml-stream) into a single avml binary with subcommands, and add direct-to-remote-storage streaming as a first-class capability.

CLI shape

avml acquire FILE [--compress] [--source S] [--max-disk-usage N]
                  [--max-disk-usage-percentage P]
                  [--url U] [--delete]
                  [--sas-url U] [--sas-block-size N] [--sas-block-concurrency N]
avml convert [--source-format F] [--format F] SRC DST
avml upload  put  FILE URL
avml upload  blob FILE URL [--sas-block-size N] [--sas-block-concurrency N]
avml stream  blob SAS_URL [--compress] [--source S]
                          [--sas-block-size N] [--sas-block-concurrency N]
avml stream  tcp  ADDR    [--compress] [--source S]

Feature flags

Three new top-level features gate which subcommands the binary includes:

feature	enables	extra deps
convert	avml convert	none
upload	avml upload {put,blob}	put + blobstore
stream	avml stream {blob,tcp}	blobstore + tokio/net

default = ["stream", "upload", "convert", "native-tls"]. The existing lower-level put/blobstore features stay for library consumers who want them in isolation. cargo build --no-default-features still produces an acquire-only binary (the previous avml-minimal shape).

Streaming subcommand

For hosts where writing the snapshot to a local file first is undesirable (read-only root, limited disk, forensic chain-of-custody concerns), stream writes bytes sequentially to a remote destination without touching local disk.

• stream blob — Azure Block Blob via stage_block + commit_block_list. Block size is derived from the iomem estimate so the snapshot fits within Azure's 50,000-block-per-blob limit (--sas-block-size is a floor, not an override). --sas-block-concurrency caps in-flight stage_block calls via a tokio::sync::Semaphore; peak RAM is roughly (concurrency + 1) * block_size. On mid-stream failure, staged blocks are abandoned without commit_block_list; Azure discards them per its 7-day default.
• stream tcp — opens a single tokio::net::TcpStream::connect and writes the bytes in order; intended for collectors like nc -l PORT > snapshot.lime. No TLS; pair with an SSH tunnel or stunnel for confidentiality.

Both subcommands pick a memory source once up front (honoring --source if given, otherwise probing kcore → /dev/crash → /dev/mem). Blob writes are not rewindable, so there is no automatic source fallback once any bytes have been emitted.

New library surface (all additive — semver-checks passes)

• image::Image::with_dst<W: Write>(format, src, dst: W) -> Result<Image<File, W>> — generic-destination companion to Image::new. Lets callers thread arbitrary writers (e.g. BlockBlobStream) through.
• snapshot::Snapshot::create_to_writer<W: Write>(&self, dst: W) — alternative to create() for non-file destinations. Never auto-retries across sources.
• snapshot::Snapshot::probe_single_source() -> Result<Source> — factored helper from the existing /dev/stdout branch.
• upload::stream::BlockBlobStream { writer(), finish_writes(), finalize().await, abort().await } — sync-write bridge over an AsyncWrite via tokio_util::io::SyncIoBridge; uploader task with Semaphore-bounded concurrency.

Layout

src/bin/avml/main.rs        (Cmd + dispatch)
src/bin/avml/acquire.rs
src/bin/avml/convert.rs     (was src/bin/avml-convert.rs)
src/bin/avml/upload.rs      (was src/bin/avml-upload.rs)
src/bin/avml/stream.rs

Wired via [[bin]] path = "src/bin/avml/main.rs" so cargo's bin autodiscovery doesn't treat each sibling as a separate binary.

Breaking CLI changes for users

before	after
avml output.lime	avml acquire output.lime
avml-convert ...	avml convert ...
avml-upload put FILE URL	avml upload put FILE URL
avml-upload upload-blob FILE URL	avml upload blob FILE URL

The previous eng/test-azure-image.sh and the GitHub Actions smoke tests are already updated. Downstream consumers that pin command lines (Azure VM Extensions configs, custom scripts) need the same one-token change.

Verification

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings -D clippy::pedantic -A clippy::missing_errors_doc
• Same clippy clean across --no-default-features, +convert, +upload, +stream, and pairwise combinations.
• cargo test --all-features — 36 lib (was 28; +8 new BlockBlobStream unit tests against an in-memory FakeStager) + 2 convert + 1 doctest.
• cargo semver-checks check-release — no semver update required (only additive public-API changes).
• cargo build --release --target x86_64-unknown-linux-musl --locked --all-features and --no-default-features both clean.
• --help output exercised end-to-end for every subcommand.