Reorganize the source checkout layout

Separate tracked source from generated artifacts so the repo root stops accumulating helper scripts, manifests, and local runtime outputs.

Move manual shell entrypoints under scripts/, manifests under config/, and the Firecracker API reference under docs/reference/. Make build and runtimebundle now target build/bin, build/runtime, and build/dist as the canonical source-checkout paths.

Update runtime discovery, helper scripts, tests, and docs to follow the new layout while keeping legacy source-checkout runtime fallbacks for existing local bundles during migration.

Validated with bash -n on the moved scripts, make build, and GOCACHE=/tmp/banger-gocache go test ./....

config/runtime-bundle.toml

@@ -0,0 +1,33 @@
+# Template manifest for local or published runtime bundle archives.
+# Keep this checked-in file empty by default; use a local manifest copy with
+# concrete `url` and `sha256` values when bootstrapping `./build/runtime/`.
+version = "v0"
+url = ""
+sha256 = ""
+bundle_root = "runtime"
+required_paths = [
+  "firecracker",
+  "customize.sh",
+  "packages.sh",
+  "namegen",
+  "banger-vsock-agent",
+  "packages.apt",
+  "id_ed25519",
+  "rootfs-docker.ext4",
+  "wtf/root/boot/vmlinux-6.8.0-94-generic",
+  "wtf/root/boot/initrd.img-6.8.0-94-generic",
+  "wtf/root/lib/modules/6.8.0-94-generic",
+]
+
+[bundle_metadata]
+firecracker_bin = "firecracker"
+ssh_key_path = "id_ed25519"
+namegen_path = "namegen"
+customize_script = "customize.sh"
+vsock_agent_path = "banger-vsock-agent"
+default_packages_file = "packages.apt"
+default_rootfs = "rootfs-docker.ext4"
+default_work_seed = "rootfs-docker.work-seed.ext4"
+default_kernel = "wtf/root/boot/vmlinux-6.8.0-94-generic"
+default_initrd = "wtf/root/boot/initrd.img-6.8.0-94-generic"
+default_modules_dir = "wtf/root/lib/modules/6.8.0-94-generic"