Read port forwards from per-VM forwards.conf files

A QEMU config file section cannot hold more than one hostfwd entry, so
the forwards move out of the ini files into qemu/<vm>/forwards.conf, one
"LABEL HOST_PORT GUEST_PORT" rule per line. The new vmforwards.py parses
them, skips rules whose host port is taken and builds the -netdev
argument, which every launcher now passes instead of relying on a
netdev section in the ini or on -nic.

The ini files move to qemu/<vm>/config.ini and qemu/<vm>/<os>-<arch>.ini.
The *_SSH_PORT / *_RDP_PORT variables and --rdp-port / --ssh-port still
replace the host port of the SSH and RDP rules.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

qemu/ubuntu2604/config.ini

@@ -0,0 +1,59 @@
+# QEMU configuration for the Ubuntu 26.04 virtual machine, shared by all
+# architectures. The accelerators, machine type and
+# platform-specific devices are in <os>-<arch>.ini (os is linux or darwin),
+# which QEMU reads after this file.
+#
+# run-ubuntu2604.py fills in the file path placeholders below, writes the result
+# to <state dir>/qemu.ini and passes it to QEMU with -readconfig. Options that
+# have no -readconfig equivalent (-cpu, -display, daemon mode) are still added
+# by the launcher.
+
+[name]
+  guest = "ubuntu2604"
+
+[memory]
+  size = "8G"
+
+[smp-opts]
+  cpus = "8"
+
+# UEFI firmware: read-only code and the per-VM variable store.
+[drive "pflash0"]
+  if = "pflash"
+  format = "raw"
+  readonly = "on"
+  file = "${uefi_code}"
+
+[drive "pflash1"]
+  if = "pflash"
+  format = "raw"
+  file = "${uefi_vars}"
+
+# Writable qcow2 overlay on top of the shared base image.
+[drive "disk0"]
+  if = "none"
+  format = "qcow2"
+  file = "${disk_image}"
+
+[device "disk0-dev"]
+  driver = "virtio-blk-pci"
+  drive = "disk0"
+
+# cloud-init seed ISO.
+[drive "seed0"]
+  if = "none"
+  format = "raw"
+  readonly = "on"
+  file = "${seed_image}"
+
+[device "seed0-dev"]
+  driver = "virtio-blk-pci"
+  drive = "seed0"
+
+# The NIC is attached to the user-mode network "net0", which the launcher
+# defines with -netdev from qemu/ubuntu2604/forwards.conf because a config file
+# section cannot hold more than one hostfwd.
+
+[device "nic0"]
+  driver = "virtio-net-pci"
+  netdev = "net0"