Add experimental Void guest workflow and vsock agent

Make iterating on a Firecracker-friendly Void guest practical without replacing the Debian default image path.

Add local Void rootfs build/register/verify plumbing, a language-agnostic dev package baseline, and guest SSH/work-disk hardening so new images use the runtime bundle key, keep a normal root bash environment, and repair stale nested /root layouts on restart.

Replace the guest PING/PONG responder with an HTTP /healthz agent over vsock, rename the runtime bundle and config surface from ping helper to agent while still accepting the legacy keys, and route the post-SSH reminder through the new vm.health path.

Validated with GOCACHE=/tmp/banger-gocache go test ./..., make build, bash -n customize.sh make-rootfs-void.sh, and git diff --check.

internal/daemon/images.go

@@ -2,9 +2,12 @@ package daemon
 
 import (
 	"context"
+	"database/sql"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"banger/internal/api"
 	"banger/internal/model"
@@ -132,6 +135,110 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (i
 	return image, nil
 }
 
+func (d *Daemon) RegisterImage(ctx context.Context, params api.ImageRegisterParams) (image model.Image, err error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	name := strings.TrimSpace(params.Name)
+	if name == "" {
+		return model.Image{}, fmt.Errorf("image name is required")
+	}
+
+	rootfsPath := strings.TrimSpace(params.RootfsPath)
+	if rootfsPath == "" {
+		return model.Image{}, fmt.Errorf("rootfs path is required")
+	}
+	workSeedPath := strings.TrimSpace(params.WorkSeedPath)
+	if workSeedPath == "" {
+		candidate := system.WorkSeedPath(rootfsPath)
+		if candidate != "" {
+			if _, statErr := os.Stat(candidate); statErr == nil {
+				workSeedPath = candidate
+			}
+		}
+	}
+	kernelPath := strings.TrimSpace(params.KernelPath)
+	if kernelPath == "" {
+		kernelPath = d.config.DefaultKernel
+	}
+	initrdPath := strings.TrimSpace(params.InitrdPath)
+	if initrdPath == "" {
+		initrdPath = d.config.DefaultInitrd
+	}
+	modulesDir := strings.TrimSpace(params.ModulesDir)
+	if modulesDir == "" {
+		modulesDir = d.config.DefaultModulesDir
+	}
+	packagesPath := strings.TrimSpace(params.PackagesPath)
+
+	if err := validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir, packagesPath); err != nil {
+		return model.Image{}, err
+	}
+
+	now := model.Now()
+	existing, lookupErr := d.store.GetImageByName(ctx, name)
+	switch {
+	case lookupErr == nil:
+		if existing.Managed {
+			return model.Image{}, fmt.Errorf("managed image %s cannot be updated via register", name)
+		}
+		image = existing
+		image.RootfsPath = rootfsPath
+		image.WorkSeedPath = workSeedPath
+		image.KernelPath = kernelPath
+		image.InitrdPath = initrdPath
+		image.ModulesDir = modulesDir
+		image.PackagesPath = packagesPath
+		image.Docker = params.Docker
+		image.UpdatedAt = now
+	case errors.Is(lookupErr, sql.ErrNoRows):
+		id, idErr := model.NewID()
+		if idErr != nil {
+			return model.Image{}, idErr
+		}
+		image = model.Image{
+			ID:           id,
+			Name:         name,
+			Managed:      false,
+			RootfsPath:   rootfsPath,
+			WorkSeedPath: workSeedPath,
+			KernelPath:   kernelPath,
+			InitrdPath:   initrdPath,
+			ModulesDir:   modulesDir,
+			PackagesPath: packagesPath,
+			Docker:       params.Docker,
+			CreatedAt:    now,
+			UpdatedAt:    now,
+		}
+	default:
+		return model.Image{}, lookupErr
+	}
+
+	if err := d.store.UpsertImage(ctx, image); err != nil {
+		return model.Image{}, err
+	}
+	return image, nil
+}
+
+func validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir, packagesPath string) error {
+	checks := system.NewPreflight()
+	checks.RequireFile(rootfsPath, "rootfs image", `pass --rootfs <path>`)
+	checks.RequireFile(kernelPath, "kernel image", `pass --kernel <path> or set "default_kernel"`)
+	if workSeedPath != "" {
+		checks.RequireFile(workSeedPath, "work-seed image", `pass --work-seed <path> or rebuild the image with a work seed`)
+	}
+	if initrdPath != "" {
+		checks.RequireFile(initrdPath, "initrd image", `pass --initrd <path> or set "default_initrd"`)
+	}
+	if modulesDir != "" {
+		checks.RequireDir(modulesDir, "kernel modules dir", `pass --modules <dir> or set "default_modules_dir"`)
+	}
+	if packagesPath != "" {
+		checks.RequireFile(packagesPath, "packages manifest", `pass --packages <path>`)
+	}
+	return checks.Err("image register failed")
+}
+
 func writePackagesMetadata(rootfsPath, packagesPath string) error {
 	if rootfsPath == "" || packagesPath == "" {
 		return nil