Fix VM lifecycle issues behind verify.sh

Make the Firecracker and bangerd processes outlive short-lived CLI request contexts so vm create no longer kills the VMM or daemon as soon as the RPC returns.

Fix fresh-VM SSH by flattening the seeded /root work disk when the copied home tree lands under a nested root/ directory, and write a guest sshd override to keep root pubkey auth explicit while debugging.

Harden teardown and smoke diagnostics: verify.sh now reports early Firecracker exit and delete failures directly, while dm snapshot cleanup tolerates already-gone handles and retries busy mapper removal long enough for Firecracker to release the device.

Validation: go test ./..., make build, bash -n verify.sh, direct SSH against a fresh VM, and a live ./verify.sh run that now completes with [verify] ok.

internal/cli/cli_test.go

@@ -244,6 +244,17 @@ func TestDaemonStatusIncludesLogPathWhenStopped(t *testing.T) {
 	}
 }
 
+func TestBuildDaemonCommandIsDetachedFromCallerContext(t *testing.T) {
+	cmd := buildDaemonCommand("/tmp/bangerd")
+
+	if cmd.Path != "/tmp/bangerd" {
+		t.Fatalf("command path = %q", cmd.Path)
+	}
+	if cmd.Cancel != nil {
+		t.Fatal("daemon process should not be tied to a CLI request context")
+	}
+}
+
 func TestAbsolutizeImageBuildPaths(t *testing.T) {
 	dir := t.TempDir()
 	prev, err := os.Getwd()