feat(workload): port the VM operational drivers (1/7)

[marceloneppel]

Issue

The VM charm still owns operational seams the library should own: the raft-observer systemd rendering, the VM storage-layout fixups, and VM-only service-name/certs constants. Final state: no logic charm-side.

Solution

• ObserverManager.start_raft_observer(): renders templates/vm/raft-observer.{service,timer}.j2 (moved from the charm) via importlib.resources and enables the timer through charmlibs.systemd (guarded platform import, patroni.py pattern). Port of the VM charm's start_raft_observer residual.
• VMWorkload.ensure_storage_layout() (+ BaseWorkload stub): recreates the versioned temp dir and chowns the versioned parents to _daemon_. Port of the VM charm's _ensure_storage_layout.
• config/literals.py: VM_METRICS_SERVICE_NAME, VM_PGBACKREST_METRICS_SERVICE_NAME, UPDATE_CERTS_BIN_PATH.
• Tests: tests/unit/test_observer_manager.py, tests/unit/test_vm_storage_layout.py (ported from the charm's unit tests).
• Note: the rotate-logs driver was found already ported (BackupManager.start/stop_log_rotation mirrors the charm RotateLogs guards 1:1) — the charm copy is deleted in the consumption PR.

Checklist

• I have added or updated any relevant documentation.
• I have cleaned any remaining cloud resources from my accounts.