chore!: update libcmt to machine-guest-tools v0.18.0

[Nonnyjoe]

Bumps the vendored machine-guest-tools submodule from v0.17.2 → v0.18.0 and adapts the bindings to its breaking changes.

Upstream changes affecting the headers bindgen consumes

Change	Kind	Impact
cmt_abi_start_frame declaration removed	breaking	abi::start_frame wrapper dropped
HTIF_YIELD_REASON_ADVANCE/_INSPECT → _ADVANCE_STATE/_INSPECT_STATE	breaking	Regenerated; no internal callers
finish_root_hash → finish_outputs_merkle_root	breaking	No internal callers
struct cmt_rollup_finish → cmt_rollup_finish_s	cosmetic	cmt_rollup_finish_t typedef absorbs it

abi::start_frame bound a symbol with no implementation behind it, so any caller already failed at link time — removing it costs nothing.

The mock's output file suffix also changed (.outputs_root_hash → .outputs_merkle_root). Upstream flagged this as breaking test harnesses that read the old name; I grepped, and nothing in this repo does.

No new public libcmt API was added, so there is nothing new to bind. The new bundled libcmt/ioctl.h is internal to io.c and is deliberately not added to wrapper.h.

Dockerfile.echoApp

• Bump the guest-tools release pin to 0.18.0 with a recomputed sha256.
• Drop the Cartesi linux-headers download. v0.18.0 vendors the cmio ioctl ABI in libcmt/ioctl.h, so libcmt no longer includes <linux/cartesi/cmio.h>. This also clears a stale pin on kernel headers v0.20.0/ctsi-1 while v0.18.0 targets ctsi-2.
• Pin the libcmt source clone to the same release the bindings are generated from. It previously cloned main unpinned, so the linked libcmt.a could silently drift from the generated bindings — a latent bug independent of this bump.

Verification

Built libcmt's host mock backend and ran the echo app against it:

• Advance and inspect both round-trip correctly.
• A byte-correct Voucher(address,uint256,bytes) is emitted (funsel 237a816f, right destination, value, and payload).
• The outputs Merkle root accumulates across inputs (82ad… → 5d77… → b2b7…) rather than resetting.
• Upstream's own libcmt v0.18.0 test suite passes on this checkout.

Also built the riscv64 cross-build-stage under Docker, confirming libcmt v0.18.0 compiles without the kernel-headers package and the app links into a working ELF 64-bit … UCB RISC-V binary.

Follow-ups (intentionally not in this PR)

• sample_apps/echo_app/Cargo.toml still pins the old crate rev, so the sample app doesn't consume this yet. Best bumped once this merges and the SHA is final. I verified the app builds and links against the updated crate, so the pin is the only thing in the way.
• Same commit is the right moment to switch main.rs:484 off the bare 0/1 literals to the HTIF_YIELD_REASON_*_STATE constants, which only exist as of this change.
• Crate is still 0.1.0 despite the breaking API change — worth bumping before tagging, since release-on-tag.yml packages the .crate from whatever is there.

BREAKING CHANGE

abi::start_frame is removed, and the re-exported HTIF_YIELD_REASON_ADVANCE/_INSPECT constants are renamed to _ADVANCE_STATE/_INSPECT_STATE.