Switch to fetched runtime bundles

Stop treating Firecracker, kernels, modules, and guest images as tracked source files. Source checkouts now resolve runtime assets from ./runtime, while installed binaries keep using ../lib/banger.

Add a small runtimebundle helper plus runtime-bundle.toml so make can bootstrap, package, and install a runtime bundle with checksum validation. Update the shell helpers and daemon path hints to fail clearly when the bundle is missing instead of assuming repo-root artifacts.

This removes the tracked runtime blobs from HEAD in favor of an ignored local runtime/ tree. Verified with go test ./..., make build, bash -n on the shell helpers, make -n install, and a temporary package/fetch smoke test. The manifest URL/SHA still need a published bundle before fresh clones can bootstrap, and history rewrite remains a separate rollout step.

cmd/runtimebundle/main.go

@@ -0,0 +1,72 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+
+	"banger/internal/runtimebundle"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	switch os.Args[1] {
+	case "fetch":
+		if err := fetch(os.Args[2:]); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+	case "package":
+		if err := pkg(os.Args[2:]); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+	default:
+		usage()
+		os.Exit(2)
+	}
+}
+
+func fetch(args []string) error {
+	fs := flag.NewFlagSet("fetch", flag.ContinueOnError)
+	fs.SetOutput(os.Stderr)
+	manifestPath := fs.String("manifest", "runtime-bundle.toml", "path to the runtime bundle manifest")
+	outDir := fs.String("out", "runtime", "destination runtime directory")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	manifest, err := runtimebundle.LoadManifest(*manifestPath)
+	if err != nil {
+		return err
+	}
+	return runtimebundle.Bootstrap(context.Background(), manifest, *manifestPath, *outDir)
+}
+
+func pkg(args []string) error {
+	fs := flag.NewFlagSet("package", flag.ContinueOnError)
+	fs.SetOutput(os.Stderr)
+	manifestPath := fs.String("manifest", "runtime-bundle.toml", "path to the runtime bundle manifest")
+	runtimeDir := fs.String("runtime-dir", "runtime", "runtime directory to package")
+	outArchive := fs.String("out", "dist/banger-runtime.tar.gz", "output archive path")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	manifest, err := runtimebundle.LoadManifest(*manifestPath)
+	if err != nil {
+		return err
+	}
+	sum, err := runtimebundle.Package(*runtimeDir, *outArchive, manifest)
+	if err != nil {
+		return err
+	}
+	fmt.Println(sum)
+	return nil
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, "usage: runtimebundle <fetch|package> [flags]")
+}