update: VMs survive banger update and rollback

Three load-bearing fixes that together let `banger update` (and its
auto-rollback path) restart the helper + daemon without killing
every running VM. New smoke scenarios prove the property end-to-end.

Bug fixes:

1. Disable the firecracker SDK's signal-forwarding goroutine. The
   default ForwardSignals = [SIGINT, SIGQUIT, SIGTERM, SIGHUP,
   SIGABRT] installs a handler in the helper that propagates the
   helper's SIGTERM (sent by systemd on `systemctl stop bangerd-
   root.service`) to every running firecracker child. Set
   ForwardSignals to an empty (non-nil) slice so setupSignals
   short-circuits at len()==0.

2. Add SendSIGKILL=no to bangerd-root.service. KillMode=process
   limits the initial SIGTERM to the helper main, but systemd
   still SIGKILLs leftover cgroup processes during the
   FinalKillSignal stage unless SendSIGKILL=no.

3. Route restart-helper / restart-daemon / wait-daemon-ready
   failures through rollbackAndRestart instead of rollbackAndWrap.
   rollbackAndWrap restored .previous binaries but didn't re-
   restart the failed unit, leaving the helper dead with the
   rolled-back binary on disk after a failed update.

Testing infrastructure (production binaries unaffected):

- Hidden --manifest-url and --pubkey-file flags on `banger update`
  let the smoke harness redirect the updater at locally-built
  release artefacts. Marked Hidden in cobra; not advertised in
  --help.
- FetchManifestFrom / VerifyBlobSignatureWithKey /
  FetchAndVerifySignatureWithKey export the existing logic against
  caller-supplied URL / pubkey. The default entry points still
  call them with the embedded canonical values.

Smoke scenarios:

- update_check: --check against fake manifest reports update
  available
- update_to_unknown: --to v9.9.9 fails before any host mutation
- update_no_root: refuses without sudo, install untouched
- update_dry_run: stages + verifies, no swap, version unchanged
- update_keeps_vm_alive: real swap to v0.smoke.0; same VM (same
  boot_id) answers SSH after the daemon restart
- update_rollback_keeps_vm_alive: v0.smoke.broken-bangerd ships a
  bangerd that passes --check-migrations but exits 1 as the
  daemon. The post-swap `systemctl restart bangerd` fails,
  rollbackAndRestart fires, the .previous binaries are restored
  and re-restarted; the same VM still answers SSH afterwards
- daemon_admin (separate prep): covers `banger daemon socket`,
  `bangerd --check-migrations --system`, `sudo banger daemon
  stop`

The smoke release builder generates a fresh ECDSA P-256 keypair
with openssl, signs SHA256SUMS cosign-compatibly, and serves
artefacts from a backgrounded python http.server.
verify_smoke_check_test.go pins the openssl/cosign signature
equivalence so the smoke release builder can't silently drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/firecracker/client.go

@@ -196,6 +196,15 @@ func buildConfig(cfg MachineConfig) sdk.Config {
 			Smt:        sdk.Bool(false),
 		},
 		VMID: cfg.VMID,
+		// Disable the SDK's signal-forwarding goroutine. Default
+		// (nil) makes the SDK install a handler that catches
+		// SIGTERM/SIGINT/SIGHUP/SIGQUIT/SIGABRT in the parent process
+		// and forwards them to the firecracker child — which means
+		// `systemctl stop bangerd-root.service` (sends SIGTERM to the
+		// helper) ends up signaling every firecracker the helper has
+		// launched, killing every running VM. Empty slice (not nil)
+		// short-circuits setupSignals at len()==0.
+		ForwardSignals: []os.Signal{},
 	}
 	if cfg.Jailer != nil {
 		// The path fields above are already chroot-translated by the
@@ -267,6 +276,7 @@ func defaultDriveID(drive DriveConfig, fallback string) string {
 // the configured UID:GID) — see fcproc.PrepareJailerChroot. The SDK's own
 // JailerCfg path is intentionally bypassed: it cannot mknod block devices and
 // does not expose --new-pid-ns.
+//
 func buildProcessRunner(cfg MachineConfig, logFile *os.File) *exec.Cmd {
 	var bin string
 	var args []string
@@ -277,9 +287,10 @@ func buildProcessRunner(cfg MachineConfig, logFile *os.File) *exec.Cmd {
 		args = []string{"--api-sock", cfg.SocketPath, "--id", cfg.VMID}
 	}
 	var cmd *exec.Cmd
-	if os.Geteuid() == 0 {
+	switch {
+	case os.Geteuid() == 0:
 		cmd = exec.Command(bin, args...)
-	} else {
+	default:
 		cmd = exec.Command("sudo", append([]string{"-n", "-E", bin}, args...)...)
 	}
 	cmd.Stdin = nil