Manage image artifacts and show VM create progress

Stop relying on ad hoc rootfs handling by adding image promotion, managed work-seed fingerprint metadata, and lazy self-healing for older managed images after the first create.

Rebuild guest images with baked SSH access, a guest NIC bootstrap, and default opencode services, and add the staged Void kernel/initramfs/modules workflow so void-exp uses a matching Void boot stack.

Replace the opaque blocking vm.create RPC with a begin/status flow that prints live stages in the CLI while still waiting for vsock health and opencode on guest port 4096.

Validate with GOCACHE=/tmp/banger-gocache go test ./... and live void-exp create/delete smoke runs.

internal/daemon/images.go

@@ -103,26 +103,33 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (i
 		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
+	seededSSHPublicKeyFingerprint, err := d.seedAuthorizedKeyOnExt4Image(ctx, workSeedPath)
+	if err != nil {
+		_ = logFile.Sync()
+		_ = os.RemoveAll(artifactDir)
+		return model.Image{}, err
+	}
 	if err := writePackagesMetadata(rootfsPath, d.config.DefaultPackagesFile); err != nil {
 		_ = logFile.Sync()
 		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
 	image = model.Image{
-		ID:           id,
-		Name:         name,
-		Managed:      true,
-		ArtifactDir:  artifactDir,
-		RootfsPath:   rootfsPath,
-		WorkSeedPath: workSeedPath,
-		KernelPath:   kernelPath,
-		InitrdPath:   initrdPath,
-		ModulesDir:   modulesDir,
-		PackagesPath: d.config.DefaultPackagesFile,
-		BuildSize:    params.Size,
-		Docker:       params.Docker,
-		CreatedAt:    now,
-		UpdatedAt:    now,
+		ID:                            id,
+		Name:                          name,
+		Managed:                       true,
+		ArtifactDir:                   artifactDir,
+		RootfsPath:                    rootfsPath,
+		WorkSeedPath:                  workSeedPath,
+		KernelPath:                    kernelPath,
+		InitrdPath:                    initrdPath,
+		ModulesDir:                    modulesDir,
+		PackagesPath:                  d.config.DefaultPackagesFile,
+		BuildSize:                     params.Size,
+		SeededSSHPublicKeyFingerprint: seededSSHPublicKeyFingerprint,
+		Docker:                        params.Docker,
+		CreatedAt:                     now,
+		UpdatedAt:                     now,
 	}
 	if err := d.store.UpsertImage(ctx, image); err != nil {
 		return model.Image{}, err
@@ -220,6 +227,105 @@ func (d *Daemon) RegisterImage(ctx context.Context, params api.ImageRegisterPara
 	return image, nil
 }
 
+func (d *Daemon) PromoteImage(ctx context.Context, idOrName string) (image model.Image, err error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	op := d.beginOperation("image.promote")
+	defer func() {
+		if err != nil {
+			op.fail(err, imageLogAttrs(image)...)
+			return
+		}
+		op.done(imageLogAttrs(image)...)
+	}()
+
+	image, err = d.FindImage(ctx, idOrName)
+	if err != nil {
+		return model.Image{}, err
+	}
+	if image.Managed {
+		return model.Image{}, fmt.Errorf("image %s is already managed", image.Name)
+	}
+	if err := validateImagePromotePaths(image.RootfsPath, image.KernelPath, image.InitrdPath, image.ModulesDir, image.PackagesPath); err != nil {
+		return model.Image{}, err
+	}
+	if strings.TrimSpace(d.layout.ImagesDir) == "" {
+		return model.Image{}, errors.New("images dir is not configured")
+	}
+	if err := os.MkdirAll(d.layout.ImagesDir, 0o755); err != nil {
+		return model.Image{}, err
+	}
+
+	artifactDir := filepath.Join(d.layout.ImagesDir, image.ID)
+	if _, statErr := os.Stat(artifactDir); statErr == nil {
+		return model.Image{}, fmt.Errorf("artifact dir already exists: %s", artifactDir)
+	} else if !os.IsNotExist(statErr) {
+		return model.Image{}, statErr
+	}
+
+	stageDir, err := os.MkdirTemp(d.layout.ImagesDir, image.ID+".promote-")
+	if err != nil {
+		return model.Image{}, err
+	}
+	cleanupStage := true
+	defer func() {
+		if cleanupStage {
+			_ = os.RemoveAll(stageDir)
+		}
+	}()
+
+	rootfsPath := filepath.Join(stageDir, "rootfs.ext4")
+	op.stage("copy_rootfs", "source_rootfs_path", image.RootfsPath, "target_rootfs_path", rootfsPath)
+	if err := system.CopyFilePreferClone(image.RootfsPath, rootfsPath); err != nil {
+		return model.Image{}, err
+	}
+
+	workSeedPath := ""
+	if image.WorkSeedPath != "" {
+		if _, statErr := os.Stat(image.WorkSeedPath); statErr != nil {
+			if os.IsNotExist(statErr) {
+				op.stage("skip_missing_work_seed", "source_work_seed_path", image.WorkSeedPath)
+				image.WorkSeedPath = ""
+			} else {
+				return model.Image{}, statErr
+			}
+		}
+	}
+	if image.WorkSeedPath != "" {
+		workSeedPath = filepath.Join(stageDir, "work-seed.ext4")
+		op.stage("copy_work_seed", "source_work_seed_path", image.WorkSeedPath, "target_work_seed_path", workSeedPath)
+		if err := system.CopyFilePreferClone(image.WorkSeedPath, workSeedPath); err != nil {
+			return model.Image{}, err
+		}
+		image.SeededSSHPublicKeyFingerprint, err = d.seedAuthorizedKeyOnExt4Image(ctx, workSeedPath)
+		if err != nil {
+			return model.Image{}, err
+		}
+	} else {
+		image.SeededSSHPublicKeyFingerprint = ""
+	}
+
+	op.stage("activate_artifacts", "artifact_dir", artifactDir)
+	if err := os.Rename(stageDir, artifactDir); err != nil {
+		return model.Image{}, err
+	}
+	cleanupStage = false
+
+	image.Managed = true
+	image.ArtifactDir = artifactDir
+	image.RootfsPath = filepath.Join(artifactDir, "rootfs.ext4")
+	if workSeedPath != "" {
+		image.WorkSeedPath = filepath.Join(artifactDir, "work-seed.ext4")
+	}
+	image.UpdatedAt = model.Now()
+	if err := d.store.UpsertImage(ctx, image); err != nil {
+		_ = os.RemoveAll(artifactDir)
+		return model.Image{}, err
+	}
+	return image, nil
+}
+
 func validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir, packagesPath string) error {
 	checks := system.NewPreflight()
 	checks.RequireFile(rootfsPath, "rootfs image", `pass --rootfs <path>`)
@@ -239,6 +345,22 @@ func validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath
 	return checks.Err("image register failed")
 }
 
+func validateImagePromotePaths(rootfsPath, kernelPath, initrdPath, modulesDir, packagesPath string) error {
+	checks := system.NewPreflight()
+	checks.RequireFile(rootfsPath, "rootfs image", `re-register the image with a valid rootfs`)
+	checks.RequireFile(kernelPath, "kernel image", `re-register the image with a valid kernel`)
+	if initrdPath != "" {
+		checks.RequireFile(initrdPath, "initrd image", `re-register the image with a valid initrd`)
+	}
+	if modulesDir != "" {
+		checks.RequireDir(modulesDir, "kernel modules dir", `re-register the image with a valid modules dir`)
+	}
+	if packagesPath != "" {
+		checks.RequireFile(packagesPath, "packages manifest", `re-register the image with a valid packages manifest`)
+	}
+	return checks.Err("image promote failed")
+}
+
 func writePackagesMetadata(rootfsPath, packagesPath string) error {
 	if rootfsPath == "" || packagesPath == "" {
 		return nil