Refactor VM lifecycle around capabilities

Make host-integrated VM features fit a standard Go extension path instead of adding more one-off branches through vm.go. This is the enabling refactor for future work like shared mounts, not the /work feature itself.

Add a daemon capability pipeline plus a structured guest-config builder, then move the existing /root work-disk mount, built-in DNS, and NAT wiring onto those hooks. Generalize Firecracker drive config at the same time so later storage features can extend machine setup without another hardcoded path.

Add banger doctor on top of the shared readiness checks, update the docs to describe the new architecture, and cover the new seams with guest-config, capability, report, CLI, and full go test verification. Also verify make build and a real ./banger doctor run on the host.

internal/firecracker/client.go

@@ -23,14 +23,20 @@ type MachineConfig struct {
 	KernelImagePath string
 	InitrdPath      string
 	KernelArgs      string
-	RootDrivePath   string
-	WorkDrivePath   string
+	Drives          []DriveConfig
 	TapDevice       string
 	VCPUCount       int
 	MemoryMiB       int
 	Logger          *slog.Logger
 }
 
+type DriveConfig struct {
+	ID       string
+	Path     string
+	ReadOnly bool
+	IsRoot   bool
+}
+
 type Machine struct {
 	machine   *sdk.Machine
 	logFile   *os.File
@@ -102,10 +108,14 @@ func openLogFile(path string) (*os.File, error) {
 }
 
 func buildConfig(cfg MachineConfig) sdk.Config {
-	drivesBuilder := sdk.NewDrivesBuilder(cfg.RootDrivePath).
-		WithRootDrive(cfg.RootDrivePath, sdk.WithDriveID("rootfs"), sdk.WithReadOnly(false))
-	if strings.TrimSpace(cfg.WorkDrivePath) != "" {
-		drivesBuilder = drivesBuilder.AddDrive(cfg.WorkDrivePath, false, sdk.WithDriveID("work"))
+	rootDrive, extraDrives := splitDrives(cfg.Drives)
+	drivesBuilder := sdk.NewDrivesBuilder(rootDrive.Path).
+		WithRootDrive(rootDrive.Path, sdk.WithDriveID(defaultDriveID(rootDrive, "rootfs")), sdk.WithReadOnly(rootDrive.ReadOnly))
+	for _, drive := range extraDrives {
+		if strings.TrimSpace(drive.Path) == "" {
+			continue
+		}
+		drivesBuilder = drivesBuilder.AddDrive(drive.Path, drive.ReadOnly, sdk.WithDriveID(defaultDriveID(drive, "drive")))
 	}
 	drives := drivesBuilder.Build()
 
@@ -131,6 +141,32 @@ func buildConfig(cfg MachineConfig) sdk.Config {
 	}
 }
 
+func splitDrives(drives []DriveConfig) (DriveConfig, []DriveConfig) {
+	root := DriveConfig{ID: "rootfs"}
+	var extras []DriveConfig
+	for _, drive := range drives {
+		if strings.TrimSpace(drive.Path) == "" {
+			continue
+		}
+		if drive.IsRoot {
+			root = drive
+			if root.ID == "" {
+				root.ID = "rootfs"
+			}
+			continue
+		}
+		extras = append(extras, drive)
+	}
+	return root, extras
+}
+
+func defaultDriveID(drive DriveConfig, fallback string) string {
+	if strings.TrimSpace(drive.ID) != "" {
+		return drive.ID
+	}
+	return fallback
+}
+
 func buildProcessRunner(cfg MachineConfig, logFile *os.File) *exec.Cmd {
 	script := "umask 000 && exec " + shellQuote(cfg.BinaryPath) +
 		" --api-sock " + shellQuote(cfg.SocketPath) +

internal/firecracker/client_test.go

@@ -16,11 +16,13 @@ func TestBuildConfig(t *testing.T) {
 		KernelImagePath: "/kernel",
 		InitrdPath:      "/initrd",
 		KernelArgs:      "console=ttyS0",
-		RootDrivePath:   "/dev/mapper/root",
-		WorkDrivePath:   "/var/lib/banger/root.ext4",
-		TapDevice:       "tap-fc-1",
-		VCPUCount:       4,
-		MemoryMiB:       2048,
+		Drives: []DriveConfig{
+			{ID: "rootfs", Path: "/dev/mapper/root", IsRoot: true},
+			{ID: "work", Path: "/var/lib/banger/root.ext4"},
+		},
+		TapDevice: "tap-fc-1",
+		VCPUCount: 4,
+		MemoryMiB: 2048,
 	})
 
 	if cfg.SocketPath != "/tmp/fc.sock" {