daemon: split owner daemon from root helper

Move the supported systemd path to two services: an owner-user bangerd for
orchestration and a narrow root helper for bridge/tap, NAT/resolver, dm/loop,
and Firecracker ownership. This removes repeated sudo from daily vm and image
flows without leaving the general daemon running as root.

Add install metadata, system install/status/restart/uninstall commands, and a
system-owned runtime layout. Keep user SSH/config material in the owner home,
lock file_sync to the owner home, and move daemon known_hosts handling out of
the old root-owned control path.

Route privileged lifecycle steps through typed privilegedOps calls, harden the
two systemd units, and rewrite smoke plus docs around the supported service
model.

Verified with make build, make test, make lint, and make smoke on the
supported systemd host path.

internal/paths/layout_test.go

@@ -38,6 +38,36 @@ func TestResolveUsesXDGOverrides(t *testing.T) {
 	}
 }
 
+func TestResolveUserForHomeUsesProvidedHome(t *testing.T) {
+	home := filepath.Join(t.TempDir(), "owner")
+	layout, err := ResolveUserForHome(home)
+	if err != nil {
+		t.Fatalf("ResolveUserForHome: %v", err)
+	}
+	if layout.ConfigDir != filepath.Join(home, ".config", "banger") {
+		t.Fatalf("ConfigDir = %q", layout.ConfigDir)
+	}
+	if layout.StateDir != filepath.Join(home, ".local", "state", "banger") {
+		t.Fatalf("StateDir = %q", layout.StateDir)
+	}
+	if layout.KnownHostsPath != filepath.Join(home, ".local", "state", "banger", "ssh", "known_hosts") {
+		t.Fatalf("KnownHostsPath = %q", layout.KnownHostsPath)
+	}
+}
+
+func TestResolveSystemUsesFixedPaths(t *testing.T) {
+	layout := ResolveSystem()
+	if layout.SocketPath != "/run/banger/bangerd.sock" {
+		t.Fatalf("SocketPath = %q", layout.SocketPath)
+	}
+	if layout.StateDir != "/var/lib/banger" {
+		t.Fatalf("StateDir = %q", layout.StateDir)
+	}
+	if layout.KnownHostsPath != "/var/lib/banger/ssh/known_hosts" {
+		t.Fatalf("KnownHostsPath = %q", layout.KnownHostsPath)
+	}
+}
+
 func TestResolveFallsBackWhenRuntimeUnset(t *testing.T) {
 	t.Setenv("XDG_RUNTIME_DIR", "")
 	layout, err := Resolve()

internal/paths/paths.go

@@ -4,9 +4,12 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"os/user"
 	"path/filepath"
 	"strings"
 	"syscall"
+
+	"banger/internal/installmeta"
 )
 
 type Layout struct {
@@ -37,6 +40,10 @@ type Layout struct {
 }
 
 func Resolve() (Layout, error) {
+	return ResolveUser()
+}
+
+func ResolveUser() (Layout, error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
 		return Layout{}, err
@@ -74,6 +81,52 @@ func Resolve() (Layout, error) {
 	return layout, nil
 }
 
+func ResolveUserForHome(home string) (Layout, error) {
+	home = strings.TrimSpace(home)
+	if home == "" {
+		return Layout{}, errors.New("home directory is required")
+	}
+	if !filepath.IsAbs(home) {
+		return Layout{}, fmt.Errorf("home directory %q must be absolute", home)
+	}
+	configHome := filepath.Join(home, ".config")
+	stateHome := filepath.Join(home, ".local", "state")
+	cacheHome := filepath.Join(home, ".cache")
+	layout := Layout{
+		ConfigHome: configHome,
+		StateHome:  stateHome,
+		CacheHome:  cacheHome,
+		ConfigDir:  filepath.Join(configHome, "banger"),
+		StateDir:   filepath.Join(stateHome, "banger"),
+		CacheDir:   filepath.Join(cacheHome, "banger"),
+		SSHDir:     filepath.Join(stateHome, "banger", "ssh"),
+	}
+	layout.KnownHostsPath = filepath.Join(layout.SSHDir, "known_hosts")
+	return layout, nil
+}
+
+func ResolveSystem() Layout {
+	layout := Layout{
+		ConfigHome:  "/etc",
+		StateHome:   "/var/lib",
+		CacheHome:   "/var/cache",
+		RuntimeHome: "/run",
+		ConfigDir:   installmeta.DefaultDir,
+		StateDir:    "/var/lib/banger",
+		CacheDir:    "/var/cache/banger",
+		RuntimeDir:  "/run/banger",
+	}
+	layout.SocketPath = installmeta.DefaultSocketPath
+	layout.DBPath = filepath.Join(layout.StateDir, "state.db")
+	layout.VMsDir = filepath.Join(layout.StateDir, "vms")
+	layout.ImagesDir = filepath.Join(layout.StateDir, "images")
+	layout.KernelsDir = filepath.Join(layout.StateDir, "kernels")
+	layout.OCICacheDir = filepath.Join(layout.CacheDir, "oci")
+	layout.SSHDir = filepath.Join(layout.StateDir, "ssh")
+	layout.KnownHostsPath = filepath.Join(layout.SSHDir, "known_hosts")
+	return layout
+}
+
 func Ensure(layout Layout) error {
 	// When we're using the /tmp fallback, we must create and own the
 	// runtime-home parent ourselves and reject any pre-existing directory
@@ -117,6 +170,53 @@ func Ensure(layout Layout) error {
 	return nil
 }
 
+func EnsureSystem(layout Layout) error {
+	if strings.TrimSpace(layout.ConfigDir) != "" {
+		if err := os.MkdirAll(layout.ConfigDir, 0o755); err != nil {
+			return err
+		}
+	}
+	for _, dir := range []string{layout.StateDir, layout.CacheDir, layout.VMsDir, layout.ImagesDir, layout.KernelsDir, layout.OCICacheDir, layout.SSHDir} {
+		if strings.TrimSpace(dir) == "" {
+			continue
+		}
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			return err
+		}
+		if err := os.Chmod(dir, 0o700); err != nil {
+			return err
+		}
+	}
+	if strings.TrimSpace(layout.RuntimeDir) != "" {
+		if err := os.MkdirAll(layout.RuntimeDir, 0o711); err != nil {
+			return err
+		}
+		if err := os.Chmod(layout.RuntimeDir, 0o711); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// EnsureSystemOwned prepares the systemd-managed directories the
+// owner-user daemon needs once systemd has already created the top-level
+// state/cache/runtime roots on its behalf. Unlike EnsureSystem, it does
+// not touch /etc/banger and it never assumes root ownership.
+func EnsureSystemOwned(layout Layout) error {
+	for _, dir := range []string{layout.StateDir, layout.CacheDir, layout.RuntimeDir, layout.VMsDir, layout.ImagesDir, layout.KernelsDir, layout.OCICacheDir, layout.SSHDir} {
+		if strings.TrimSpace(dir) == "" {
+			continue
+		}
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			return err
+		}
+		if err := os.Chmod(dir, 0o700); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // ensureSafeRuntimeHome creates path at 0700 if missing, or validates
 // existing ownership + mode. Returns an error describing how to remediate
 // when the existing directory doesn't meet the bar.
@@ -169,6 +269,21 @@ func BangerdPath() (string, error) {
 	return "", errors.New("bangerd binary not found next to banger; run `make build`")
 }
 
+func BangerPath() (string, error) {
+	if env := os.Getenv("BANGER_BIN"); env != "" {
+		return env, nil
+	}
+	return executablePath()
+}
+
+func CurrentUsername() (string, error) {
+	entry, err := user.Current()
+	if err != nil {
+		return "", err
+	}
+	return entry.Username, nil
+}
+
 func CompanionBinaryPath(name string) (string, error) {
 	envNames := []string{
 		"BANGER_" + strings.ToUpper(strings.NewReplacer("-", "_", ".", "_").Replace(name)) + "_BIN",