Move subsystem state/locks off Daemon into owning types

Daemon no longer owns a coarse mu shared across unrelated concerns.
Each subsystem now carries its own state and lock:

- tapPool: entries, next, and mu move onto a new tapPool struct.
- sessionRegistry: sessionControllers + its mutex move off Daemon.
- opRegistry[T asyncOp]: generic registry collapses the two ad-hoc
  vm-create and image-build operation maps (and their mutexes) into one
  shared type; the Begin/Status/Cancel/Prune methods simplify.
- vmLockSet: the sync.Map of per-VM mutexes moves into its own type;
  lockVMID forwards.
- Daemon.mu splits into imageOpsMu (image-registry mutations) and
  createVMMu (CreateVM serialisation) so image ops and VM creates no
  longer block each other.

Lock ordering collapses to vmLocks[id] -> {createVMMu, imageOpsMu} ->
subsystem-local leaves. doc.go and ARCHITECTURE.md updated.

No behavior change; tests green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/daemon/vm_locks.go

@@ -0,0 +1,19 @@
+package daemon
+
+import "sync"
+
+// vmLockSet maps VM IDs to per-VM mutexes. Concurrent operations on different
+// VMs run in parallel; concurrent operations on the same VM serialise.
+type vmLockSet struct {
+	byID sync.Map // map[string]*sync.Mutex
+}
+
+// lock acquires the mutex for the given VM ID and returns its unlock func.
+// LoadOrStore is atomic — exactly one *sync.Mutex wins for each ID, so there
+// is no release-then-reacquire TOCTOU window.
+func (s *vmLockSet) lock(id string) func() {
+	val, _ := s.byID.LoadOrStore(id, &sync.Mutex{})
+	mu := val.(*sync.Mutex)
+	mu.Lock()
+	return mu.Unlock
+}