Add experimental Void guest workflow and vsock agent

Make iterating on a Firecracker-friendly Void guest practical without replacing the Debian default image path.

Add local Void rootfs build/register/verify plumbing, a language-agnostic dev package baseline, and guest SSH/work-disk hardening so new images use the runtime bundle key, keep a normal root bash environment, and repair stale nested /root layouts on restart.

Replace the guest PING/PONG responder with an HTTP /healthz agent over vsock, rename the runtime bundle and config surface from ping helper to agent while still accepting the legacy keys, and route the post-SSH reminder through the new vm.health path.

Validated with GOCACHE=/tmp/banger-gocache go test ./..., make build, bash -n customize.sh make-rootfs-void.sh, and git diff --check.

cmd/banger-vsock-agent/main.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	sdkvsock "github.com/firecracker-microvm/firecracker-go-sdk/vsock"
+	"github.com/sirupsen/logrus"
+
+	"banger/internal/vsockagent"
+)
+
+func main() {
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer cancel()
+
+	logger := logrus.New()
+	logger.SetOutput(io.Discard)
+	listener, err := sdkvsock.Listener(ctx, logrus.NewEntry(logger), vsockagent.Port)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "banger-vsock-agent: %v\n", err)
+		os.Exit(1)
+	}
+	defer listener.Close()
+
+	server := &http.Server{
+		Handler:           vsockagent.NewHandler(),
+		ReadHeaderTimeout: 3 * time.Second,
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- server.Serve(listener)
+	}()
+
+	select {
+	case <-ctx.Done():
+		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer shutdownCancel()
+		_ = server.Shutdown(shutdownCtx)
+		if err := <-errCh; err != nil && !errors.Is(err, http.ErrServerClosed) {
+			fmt.Fprintf(os.Stderr, "banger-vsock-agent: %v\n", err)
+			os.Exit(1)
+		}
+	case err := <-errCh:
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			fmt.Fprintf(os.Stderr, "banger-vsock-agent: %v\n", err)
+			os.Exit(1)
+		}
+	}
+}

cmd/banger-vsock-pingd/main.go

@@ -1,49 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	sdkvsock "github.com/firecracker-microvm/firecracker-go-sdk/vsock"
-	"github.com/sirupsen/logrus"
-
-	"banger/internal/vsockping"
-)
-
-func main() {
-	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer cancel()
-
-	logger := logrus.New()
-	logger.SetOutput(io.Discard)
-	listener, err := sdkvsock.Listener(ctx, logrus.NewEntry(logger), vsockping.Port)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "banger-vsock-pingd: %v\n", err)
-		os.Exit(1)
-	}
-	defer listener.Close()
-
-	for {
-		conn, err := listener.Accept()
-		if err != nil {
-			if ctx.Err() != nil || errors.Is(err, net.ErrClosed) {
-				return
-			}
-			fmt.Fprintf(os.Stderr, "banger-vsock-pingd: accept: %v\n", err)
-			time.Sleep(200 * time.Millisecond)
-			continue
-		}
-		go func(conn net.Conn) {
-			if err := vsockping.ServeConn(conn); err != nil {
-				fmt.Fprintf(os.Stderr, "banger-vsock-pingd: %v\n", err)
-			}
-		}(conn)
-	}
-}