Firecracker hid eIBRS from guests on newer host kernels

KVM since 6.13 only returns those bits after the guest CPU identity is in place. ## Notes 4681a67f712a (Takahiro Itazuri, 2026-08-16). Fix CPUID-dependent MSR read ordering. On T2CL, KVM_GET_MSRS returned zero for IA32_ARCH_CAPABILITIES because guest CPUID was not installed yet. The template passthrough mask kept the zero IBRS_ALL bit and KVM_SET_MSRS overwrote KVM’s later value. Guest did not observe eIBRS and selected retpoline. Now: apply CPUID modifiers, SET_CPUID2 on every vCPU, GET_MSRS from vCPU 0, apply MSR modifiers, then SET_MSRS. b851857505c7 preparatory split of CPUID, MSR, and remaining boot setup. No functional change intended. d9edec6f4646 removes the obsolete x86 compatibility wrappers after the staged path is wired. 4aa9bb83c1c1 and 9c493b4dadc4 are tests and T2CL MSR baseline updates. Kernel behavior from a5d563890b8f (Linux 6.13). PR #6120. Landed on main. Latest release remains v1.16.1. No GHSA. Not 3fa4e75c pause-hang. Not virtio OOB.