daemon: split owner daemon from root helper

Move the supported systemd path to two services: an owner-user bangerd for
orchestration and a narrow root helper for bridge/tap, NAT/resolver, dm/loop,
and Firecracker ownership. This removes repeated sudo from daily vm and image
flows without leaving the general daemon running as root.

Add install metadata, system install/status/restart/uninstall commands, and a
system-owned runtime layout. Keep user SSH/config material in the owner home,
lock file_sync to the owner home, and move daemon known_hosts handling out of
the old root-owned control path.

Route privileged lifecycle steps through typed privilegedOps calls, harden the
two systemd units, and rewrite smoke plus docs around the supported service
model.

Verified with make build, make test, make lint, and make smoke on the
supported systemd host path.

internal/installmeta/installmeta.go

@@ -0,0 +1,114 @@
+package installmeta
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	toml "github.com/pelletier/go-toml"
+)
+
+const (
+	DefaultDir                  = "/etc/banger"
+	DefaultPath                 = DefaultDir + "/install.toml"
+	DefaultService              = "bangerd.service"
+	DefaultRootHelperService    = "bangerd-root.service"
+	DefaultSocketPath           = "/run/banger/bangerd.sock"
+	DefaultRootHelperRuntimeDir = "/run/banger-root"
+	DefaultRootHelperSocketPath = DefaultRootHelperRuntimeDir + "/bangerd-root.sock"
+)
+
+type Metadata struct {
+	OwnerUser   string    `toml:"owner_user"`
+	OwnerUID    int       `toml:"owner_uid"`
+	OwnerGID    int       `toml:"owner_gid"`
+	OwnerHome   string    `toml:"owner_home"`
+	InstalledAt time.Time `toml:"installed_at"`
+	Version     string    `toml:"version,omitempty"`
+	Commit      string    `toml:"commit,omitempty"`
+	BuiltAt     string    `toml:"built_at,omitempty"`
+}
+
+func LookupOwner(name string) (Metadata, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return Metadata{}, fmt.Errorf("owner username is required")
+	}
+	entry, err := user.Lookup(name)
+	if err != nil {
+		return Metadata{}, err
+	}
+	uid, err := strconv.Atoi(entry.Uid)
+	if err != nil {
+		return Metadata{}, fmt.Errorf("parse owner uid %q: %w", entry.Uid, err)
+	}
+	gid, err := strconv.Atoi(entry.Gid)
+	if err != nil {
+		return Metadata{}, fmt.Errorf("parse owner gid %q: %w", entry.Gid, err)
+	}
+	home := strings.TrimSpace(entry.HomeDir)
+	if home == "" || !filepath.IsAbs(home) {
+		return Metadata{}, fmt.Errorf("owner %q has invalid home directory %q", name, entry.HomeDir)
+	}
+	return Metadata{
+		OwnerUser: name,
+		OwnerUID:  uid,
+		OwnerGID:  gid,
+		OwnerHome: home,
+	}, nil
+}
+
+func Load(path string) (Metadata, error) {
+	if strings.TrimSpace(path) == "" {
+		path = DefaultPath
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return Metadata{}, err
+	}
+	var meta Metadata
+	if err := toml.Unmarshal(data, &meta); err != nil {
+		return Metadata{}, err
+	}
+	if err := meta.Validate(); err != nil {
+		return Metadata{}, err
+	}
+	return meta, nil
+}
+
+func Save(path string, meta Metadata) error {
+	if strings.TrimSpace(path) == "" {
+		path = DefaultPath
+	}
+	if err := meta.Validate(); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	data, err := toml.Marshal(meta)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path, data, 0o644)
+}
+
+func (m Metadata) Validate() error {
+	if strings.TrimSpace(m.OwnerUser) == "" {
+		return fmt.Errorf("install metadata missing owner_user")
+	}
+	if m.OwnerUID < 0 {
+		return fmt.Errorf("install metadata has invalid owner_uid %d", m.OwnerUID)
+	}
+	if m.OwnerGID < 0 {
+		return fmt.Errorf("install metadata has invalid owner_gid %d", m.OwnerGID)
+	}
+	if strings.TrimSpace(m.OwnerHome) == "" || !filepath.IsAbs(m.OwnerHome) {
+		return fmt.Errorf("install metadata has invalid owner_home %q", m.OwnerHome)
+	}
+	return nil
+}

internal/installmeta/installmeta_test.go

@@ -0,0 +1,39 @@
+package installmeta
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSaveLoadRoundTrip(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "install.toml")
+	want := Metadata{
+		OwnerUser:   "dev",
+		OwnerUID:    1000,
+		OwnerGID:    1000,
+		OwnerHome:   "/home/dev",
+		InstalledAt: time.Unix(1710000000, 0).UTC(),
+		Version:     "v1.2.3",
+		Commit:      "abc123",
+		BuiltAt:     "2026-04-23T00:00:00Z",
+	}
+
+	if err := Save(path, want); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	got, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got != want {
+		t.Fatalf("Load() = %+v, want %+v", got, want)
+	}
+}
+
+func TestValidateRejectsMissingOwner(t *testing.T) {
+	err := Metadata{OwnerUID: 1000, OwnerGID: 1000, OwnerHome: "/home/dev"}.Validate()
+	if err == nil {
+		t.Fatal("Validate() = nil, want missing owner_user error")
+	}
+}