daemon: split owner daemon from root helper

Move the supported systemd path to two services: an owner-user bangerd for
orchestration and a narrow root helper for bridge/tap, NAT/resolver, dm/loop,
and Firecracker ownership. This removes repeated sudo from daily vm and image
flows without leaving the general daemon running as root.

Add install metadata, system install/status/restart/uninstall commands, and a
system-owned runtime layout. Keep user SSH/config material in the owner home,
lock file_sync to the owner home, and move daemon known_hosts handling out of
the old root-owned control path.

Route privileged lifecycle steps through typed privilegedOps calls, harden the
two systemd units, and rewrite smoke plus docs around the supported service
model.

Verified with make build, make test, make lint, and make smoke on the
supported systemd host path.

docs/dns-routing.md

@@ -1,6 +1,6 @@
 # DNS routing — resolving `<vm>.vm` hostnames from the host
 
-banger's daemon runs a local DNS server on `127.0.0.1:42069` that
+banger's owner daemon runs a local DNS server on `127.0.0.1:42069` that
 answers queries under the `.vm` zone. Every VM you create gets a
 record:
 
@@ -17,11 +17,25 @@ curl http://devbox.vm:3000
 
 from anywhere on the host without copy-pasting guest IPs.
 
+## Supported path
+
+The supported host-side path is:
+
+- `systemd` on the host
+- `bangerd.service` running as the owner user
+- `bangerd-root.service` running as the privileged host helper
+- `systemd-resolved` handling `.vm` routing via `resolvectl`
+
+If you're on a non-`systemd` host or a host without `systemd-resolved`,
+the recipes below are best-effort guidance, not the primary supported
+deployment model.
+
 ## systemd-resolved hosts — nothing to configure
 
 If your host uses `systemd-resolved` (most modern Linux desktops —
 Ubuntu ≥18.04, Fedora, Arch with the service enabled), banger
-auto-wires it. On daemon start it runs:
+auto-wires it. When the banger services start, the owner daemon asks
+the root helper to apply the equivalent of:
 
 ```
 sudo resolvectl dns      <bridge>  127.0.0.1:42069
@@ -36,12 +50,20 @@ your normal upstream. No other changes needed.
 Verify: `resolvectl status br-fc` should list `127.0.0.1:42069` under
 **Current DNS Server** and `~vm` under **DNS Domain**.
 
-`banger daemon stop` reverts the bridge's resolvectl state on shutdown.
+Stopping or uninstalling the services reverts the bridge's
+`resolvectl` state on shutdown:
+
+```bash
+sudo banger daemon stop
+sudo banger system uninstall
+```
 
 ## Non-systemd-resolved hosts
 
 banger detects `resolvectl`'s absence and skips the auto-wire. You
 configure your own resolver. Below are recipes for the common cases.
+They can be useful in local experiments, but this is outside banger's
+supported host/runtime path.
 
 In every case the goal is the same: **route `.vm` queries to
 `127.0.0.1` port `42069`, leave everything else alone**.
@@ -114,12 +136,13 @@ the VM either doesn't exist under that name or isn't running yet.
 ## Troubleshooting
 
 - **`resolvectl` errors about "system has not been booted with systemd
-  as init system"** — you're probably inside a container. banger's
-  DNS still works; set up your resolver manually.
+  as init system"** — you're probably inside a container or on a
+  non-`systemd` host. Manual resolver setup may still work, but that's
+  outside the supported path.
 - **Port 42069 already in use** — another daemon is bound there
   (previous banger instance not shut down cleanly, or an unrelated
-  app). `ss -ulpn | grep 42069` shows who. `banger daemon stop`
-  cleans up banger's own listener.
+  app). `ss -ulpn | grep 42069` shows who. `sudo banger daemon stop`
+  stops both banger services and cleans up banger's own listener.
 - **`devbox.vm` resolves but SSH hangs** — DNS is fine; the VM
   might not be up yet or the bridge NAT is misconfigured.
   `banger vm ssh devbox` uses the guest IP directly and bypasses