Add experimental Void guest workflow and vsock agent

Make iterating on a Firecracker-friendly Void guest practical without replacing the Debian default image path.

Add local Void rootfs build/register/verify plumbing, a language-agnostic dev package baseline, and guest SSH/work-disk hardening so new images use the runtime bundle key, keep a normal root bash environment, and repair stale nested /root layouts on restart.

Replace the guest PING/PONG responder with an HTTP /healthz agent over vsock, rename the runtime bundle and config surface from ping helper to agent while still accepting the legacy keys, and route the post-SSH reminder through the new vm.health path.

Validated with GOCACHE=/tmp/banger-gocache go test ./..., make build, bash -n customize.sh make-rootfs-void.sh, and git diff --check.

internal/vsockagent/vsockagent_test.go

@@ -0,0 +1,133 @@
+package vsockagent
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestNewHandlerHealthz(t *testing.T) {
+	t.Parallel()
+
+	req, err := http.NewRequest(http.MethodGet, HealthPath, nil)
+	if err != nil {
+		t.Fatalf("NewRequest: %v", err)
+	}
+	rr := newTestResponseRecorder()
+	NewHandler().ServeHTTP(rr, req)
+
+	if rr.status != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rr.status, http.StatusOK)
+	}
+	if got := rr.headers.Get("Content-Type"); got != "application/json" {
+		t.Fatalf("content-type = %q", got)
+	}
+	var payload HealthResponse
+	if err := json.Unmarshal(rr.body.Bytes(), &payload); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if payload.Status != HealthyStatus {
+		t.Fatalf("status = %q, want %q", payload.Status, HealthyStatus)
+	}
+}
+
+func TestHealth(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	socketPath := filepath.Join(dir, "fc.vsock")
+	listener, err := net.Listen("unix", socketPath)
+	if err != nil {
+		t.Fatalf("Listen: %v", err)
+	}
+	defer listener.Close()
+
+	done := make(chan error, 1)
+	go func() {
+		conn, err := listener.Accept()
+		if err != nil {
+			done <- err
+			return
+		}
+		defer conn.Close()
+
+		buf := make([]byte, 0, 256)
+		tmp := make([]byte, 256)
+		for {
+			n, err := conn.Read(tmp)
+			if err != nil {
+				done <- err
+				return
+			}
+			buf = append(buf, tmp[:n]...)
+			if strings.Contains(string(buf), "\n") {
+				break
+			}
+		}
+		if got := string(buf); got != "CONNECT 42070\n" {
+			done <- unexpectedStringError(got)
+			return
+		}
+		if _, err := conn.Write([]byte("OK 55\n")); err != nil {
+			done <- err
+			return
+		}
+
+		buf = buf[:0]
+		for {
+			n, err := conn.Read(tmp)
+			if err != nil {
+				done <- err
+				return
+			}
+			buf = append(buf, tmp[:n]...)
+			if strings.Contains(string(buf), "\r\n\r\n") {
+				break
+			}
+		}
+		req := string(buf)
+		if !strings.Contains(req, "GET /healthz HTTP/1.1\r\n") {
+			done <- unexpectedStringError(req)
+			return
+		}
+		_, err = conn.Write([]byte("HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 15\r\n\r\n{\"status\":\"ok\"}"))
+		done <- err
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := Health(ctx, nil, socketPath); err != nil {
+		t.Fatalf("Health: %v", err)
+	}
+	if err := <-done; err != nil {
+		t.Fatalf("server: %v", err)
+	}
+}
+
+type testResponseRecorder struct {
+	headers http.Header
+	body    bytes.Buffer
+	status  int
+}
+
+func newTestResponseRecorder() *testResponseRecorder {
+	return &testResponseRecorder{headers: make(http.Header), status: http.StatusOK}
+}
+
+func (r *testResponseRecorder) Header() http.Header { return r.headers }
+
+func (r *testResponseRecorder) Write(data []byte) (int, error) { return r.body.Write(data) }
+
+func (r *testResponseRecorder) WriteHeader(status int) { r.status = status }
+
+type unexpectedStringError string
+
+func (e unexpectedStringError) Error() string {
+	return "unexpected string: " + string(e)
+}