Reorganize the source checkout layout

Separate tracked source from generated artifacts so the repo root stops accumulating helper scripts, manifests, and local runtime outputs.

Move manual shell entrypoints under scripts/, manifests under config/, and the Firecracker API reference under docs/reference/. Make build and runtimebundle now target build/bin, build/runtime, and build/dist as the canonical source-checkout paths.

Update runtime discovery, helper scripts, tests, and docs to follow the new layout while keeping legacy source-checkout runtime fallbacks for existing local bundles during migration.

Validated with bash -n on the moved scripts, make build, and GOCACHE=/tmp/banger-gocache go test ./....

scripts/make-rootfs.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+log() {
+  printf '[make-rootfs] %s\n' "$*"
+}
+
+usage() {
+  cat <<'EOF'
+Usage: ./scripts/make-rootfs.sh [--size <size>] [--base-rootfs <path>]
+
+Builds build/runtime/rootfs-docker.ext4 using scripts/customize.sh. If
+--base-rootfs is omitted, the first existing file is used:
+  ./build/runtime/rootfs.ext4
+  ./runtime/rootfs.ext4  (legacy fallback)
+  ./ubuntu-noble-rootfs/rootfs.ext4
+  ./ubuntu-lts/rootfs.ext4
+EOF
+}
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+source "$SCRIPT_DIR/lib/packages.sh"
+DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
+if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
+  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
+fi
+RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
+if [[ ! -d "$RUNTIME_DIR" ]]; then
+  log "runtime bundle not found: $RUNTIME_DIR"
+  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
+  exit 1
+fi
+OUT_ROOTFS="$RUNTIME_DIR/rootfs-docker.ext4"
+SIZE_SPEC="6G"
+BASE_ROOTFS=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --size)
+      SIZE_SPEC="${2:-}"
+      shift 2
+      ;;
+    --base-rootfs)
+      BASE_ROOTFS="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      log "unknown option: $1"
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -f "$OUT_ROOTFS" ]]; then
+  OUT_ROOTFS_WARNING="$(banger_rootfs_manifest_warning "$OUT_ROOTFS" || true)"
+  if [[ -n "$OUT_ROOTFS_WARNING" ]]; then
+    log "warning: $OUT_ROOTFS_WARNING"
+  fi
+  log "already exists: $OUT_ROOTFS"
+  exit 0
+fi
+
+if [[ -z "$BASE_ROOTFS" ]]; then
+  if [[ -f "$RUNTIME_DIR/rootfs.ext4" ]]; then
+    BASE_ROOTFS="$RUNTIME_DIR/rootfs.ext4"
+  elif [[ -f "$REPO_ROOT/ubuntu-noble-rootfs/rootfs.ext4" ]]; then
+    BASE_ROOTFS="$REPO_ROOT/ubuntu-noble-rootfs/rootfs.ext4"
+  elif [[ -f "$REPO_ROOT/ubuntu-lts/rootfs.ext4" ]]; then
+    BASE_ROOTFS="$REPO_ROOT/ubuntu-lts/rootfs.ext4"
+  else
+    log "no base rootfs found; run 'make runtime-bundle' or pass --base-rootfs"
+    exit 1
+  fi
+fi
+
+mkdir -p "$RUNTIME_DIR"
+
+log "building $OUT_ROOTFS from $BASE_ROOTFS"
+exec env BANGER_RUNTIME_DIR="$RUNTIME_DIR" "$SCRIPT_DIR/customize.sh" "$BASE_ROOTFS" \
+  --out "$OUT_ROOTFS" \
+  --size "$SIZE_SPEC" \
+  --docker