daemon: split owner daemon from root helper

Move the supported systemd path to two services: an owner-user bangerd for
orchestration and a narrow root helper for bridge/tap, NAT/resolver, dm/loop,
and Firecracker ownership. This removes repeated sudo from daily vm and image
flows without leaving the general daemon running as root.

Add install metadata, system install/status/restart/uninstall commands, and a
system-owned runtime layout. Keep user SSH/config material in the owner home,
lock file_sync to the owner home, and move daemon known_hosts handling out of
the old root-owned control path.

Route privileged lifecycle steps through typed privilegedOps calls, harden the
two systemd units, and rewrite smoke plus docs around the supported service
model.

Verified with make build, make test, make lint, and make smoke on the
supported systemd host path.

internal/daemon/ARCHITECTURE.md

@@ -2,16 +2,34 @@
 
 This document describes the current daemon package layout: the `Daemon`
 composition root, the four services it wires together, the subpackages
-that own stateless helpers, and the lock ordering every caller must
+that own stateless helpers, the privileged-ops seam used by the
+supported system install, and the lock ordering every caller must
 respect.
 
+## Supported service topology
+
+On the supported host path (`banger system install` on a `systemd`
+host), banger runs as two cooperating services:
+
+- `bangerd.service` runs as the configured owner user. It owns the
+  public RPC socket, store, image state, workspace prep, and the
+  lifecycle state machine.
+- `bangerd-root.service` runs as root. It owns only the privileged
+  host-kernel operations: bridge/tap, NAT/resolver routing, dm/loop
+  snapshot plumbing, privileged ext4 mutation on dm devices, and
+  firecracker process/socket ownership.
+
+The owner daemon talks to the root helper through the `privilegedOps`
+seam. Non-system/dev paths still use the same seam, but it is backed
+by an in-process adapter instead of the helper RPC client.
+
 ## Composition
 
 `Daemon` is a thin composition root. It holds shared infrastructure
-(store, runner, logger, layout, config, listener) plus pointers to
-four focused services. RPC dispatch is a pure forwarder into those
-services; no lifecycle / image / workspace / networking behaviour
-lives on `*Daemon` itself.
+(store, runner, logger, layout, config, listener, privileged-ops
+adapter) plus pointers to four focused services. RPC dispatch is a
+pure forwarder into those services; no lifecycle / image / workspace /
+networking behaviour lives on `*Daemon` itself.
 
 ```
 Daemon
@@ -62,6 +80,9 @@ idempotent and skips anything already set.
 
 - `tapPool` — TAP interface pool, owns its own lock.
 - `vmDNS *vmdns.Server` — in-process DNS server for `.vm` names.
+- `privilegedOps` — the host-kernel seam used for bridge/tap/NAT,
+  resolver routing, dm snapshots, privileged ext4 mutation, and
+  firecracker ownership/kill flows.
 - No direct VM-state access. Where an operation needs a VM's tap name
   (e.g. `ensureNAT`), the signature takes `guestIP` + `tap` string so
   the caller (VMService) resolves them first.
@@ -176,13 +197,17 @@ Notes:
 rehydrates the handle cache, reaps stale VMs, and republishes DNS
 records. `Daemon.backgroundLoop()` is the ticker fan-out —
 `VMService.pollStats`, `VMService.stopStaleVMs`, and
-`VMService.pruneVMCreateOperations` run on independent tickers.
+`VMService.pruneVMCreateOperations` run on independent tickers. On the
+supported system path, any reconcile-time host cleanup that needs
+privilege goes through `privilegedOps`, not directly through the owner
+daemon process.
 
 ## External API
 
 Only `internal/cli` imports this package. The surface is:
 
 - `daemon.Open(ctx) (*Daemon, error)`
+- `daemon.OpenSystem(ctx) (*Daemon, error)`
 - `(*Daemon).Serve(ctx) error`
 - `(*Daemon).Close() error`
 - `daemon.Doctor(...)` — host diagnostics (no receiver).