Manage image artifacts and show VM create progress

Stop relying on ad hoc rootfs handling by adding image promotion, managed work-seed fingerprint metadata, and lazy self-healing for older managed images after the first create.

Rebuild guest images with baked SSH access, a guest NIC bootstrap, and default opencode services, and add the staged Void kernel/initramfs/modules workflow so void-exp uses a matching Void boot stack.

Replace the opaque blocking vm.create RPC with a begin/status flow that prints live stages in the CLI while still waiting for vsock health and opencode on guest port 4096.

Validate with GOCACHE=/tmp/banger-gocache go test ./... and live void-exp create/delete smoke runs.

internal/daemon/capabilities_test.go

@@ -143,3 +143,15 @@ func TestContributeHooksPopulateGuestAndMachineConfig(t *testing.T) {
 		t.Fatalf("guest fstab = %q, want %q", fstab, want)
 	}
 }
+
+func TestRegisteredCapabilitiesIncludeOpencode(t *testing.T) {
+	d := &Daemon{}
+	var names []string
+	for _, capability := range d.registeredCapabilities() {
+		names = append(names, capability.Name())
+	}
+	want := []string{"work-disk", "opencode", "dns", "nat"}
+	if !reflect.DeepEqual(names, want) {
+		t.Fatalf("capabilities = %v, want %v", names, want)
+	}
+}