Switch to fetched runtime bundles

Stop treating Firecracker, kernels, modules, and guest images as tracked source files. Source checkouts now resolve runtime assets from ./runtime, while installed binaries keep using ../lib/banger.

Add a small runtimebundle helper plus runtime-bundle.toml so make can bootstrap, package, and install a runtime bundle with checksum validation. Update the shell helpers and daemon path hints to fail clearly when the bundle is missing instead of assuming repo-root artifacts.

This removes the tracked runtime blobs from HEAD in favor of an ignored local runtime/ tree. Verified with go test ./..., make build, bash -n on the shell helpers, make -n install, and a temporary package/fetch smoke test. The manifest URL/SHA still need a published bundle before fresh clones can bootstrap, and history rewrite remains a separate rollout step.

internal/daemon/images.go

@@ -9,6 +9,7 @@ import (
 
 	"banger/internal/api"
 	"banger/internal/model"
+	"banger/internal/paths"
 )
 
 func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (model.Image, error) {
@@ -27,7 +28,7 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (m
 		baseRootfs = d.config.DefaultBaseRootfs
 	}
 	if baseRootfs == "" {
-		return model.Image{}, fmt.Errorf("base rootfs is required")
+		return model.Image{}, fmt.Errorf("base rootfs is required; %s", paths.RuntimeBundleHint())
 	}
 	id, err := model.NewID()
 	if err != nil {
@@ -41,10 +42,10 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (m
 	rootfsPath := filepath.Join(artifactDir, "rootfs.ext4")
 	script := d.config.CustomizeScript
 	if script == "" {
-		return model.Image{}, fmt.Errorf("customize script not configured; set runtime_dir or customize_script in config.toml")
+		return model.Image{}, fmt.Errorf("customize script not configured; %s", paths.RuntimeBundleHint())
 	}
 	if _, err := os.Stat(script); err != nil {
-		return model.Image{}, fmt.Errorf("customize.sh not found at %s", script)
+		return model.Image{}, fmt.Errorf("customize.sh not found at %s; %s", script, paths.RuntimeBundleHint())
 	}
 	args := []string{script, baseRootfs, "--out", rootfsPath}
 	if params.Size != "" {

internal/daemon/vm.go

@@ -13,6 +13,7 @@ import (
 	"banger/internal/api"
 	"banger/internal/firecracker"
 	"banger/internal/model"
+	"banger/internal/paths"
 	"banger/internal/system"
 )
 
@@ -275,6 +276,49 @@ func (d *Daemon) StopVM(ctx context.Context, idOrName string) (model.VMRecord, e
 	return vm, nil
 }
 
+func (d *Daemon) KillVM(ctx context.Context, params api.VMKillParams) (model.VMRecord, error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	vm, err := d.FindVM(ctx, params.IDOrName)
+	if err != nil {
+		return model.VMRecord{}, err
+	}
+	if vm.State != model.VMStateRunning || !system.ProcessRunning(vm.Runtime.PID, vm.Runtime.APISockPath) {
+		if err := d.cleanupRuntime(ctx, vm, true); err != nil {
+			return model.VMRecord{}, err
+		}
+		vm.State = model.VMStateStopped
+		vm.Runtime.State = model.VMStateStopped
+		clearRuntimeHandles(&vm)
+		if err := d.store.UpsertVM(ctx, vm); err != nil {
+			return model.VMRecord{}, err
+		}
+		return vm, nil
+	}
+
+	signal := strings.TrimSpace(params.Signal)
+	if signal == "" {
+		signal = "TERM"
+	}
+	if _, err := d.runner.RunSudo(ctx, "kill", "-"+signal, strconv.Itoa(vm.Runtime.PID)); err != nil {
+		return model.VMRecord{}, err
+	}
+	if err := d.waitForExit(ctx, vm.Runtime.PID, vm.Runtime.APISockPath, 30*time.Second); err != nil {
+		return model.VMRecord{}, err
+	}
+	if err := d.cleanupRuntime(ctx, vm, true); err != nil {
+		return model.VMRecord{}, err
+	}
+	vm.State = model.VMStateStopped
+	vm.Runtime.State = model.VMStateStopped
+	clearRuntimeHandles(&vm)
+	system.TouchNow(&vm)
+	if err := d.store.UpsertVM(ctx, vm); err != nil {
+		return model.VMRecord{}, err
+	}
+	return vm, nil
+}
 
 func (d *Daemon) RestartVM(ctx context.Context, idOrName string) (model.VMRecord, error) {
 	vm, err := d.StopVM(ctx, idOrName)
@@ -547,11 +591,11 @@ func (d *Daemon) createTap(ctx context.Context, tap string) error {
 
 func (d *Daemon) firecrackerBinary() (string, error) {
 	if d.config.FirecrackerBin == "" {
-		return "", errors.New("firecracker binary not configured; set runtime_dir or firecracker_bin in config.toml")
+		return "", fmt.Errorf("firecracker binary not configured; %s", paths.RuntimeBundleHint())
 	}
 	path := d.config.FirecrackerBin
 	if !exists(path) {
-		return "", fmt.Errorf("firecracker binary not found at %s", path)
+		return "", fmt.Errorf("firecracker binary not found at %s; %s", path, paths.RuntimeBundleHint())
 	}
 	return path, nil
 }