Prune legacy void/alpine + customize.sh flows

The golden-image Dockerfile + catalog pipeline replaces the entire
manual rootfs-build stack. With that shipped, the per-distro shell
flows are dead code.

Removed:
- scripts/customize.sh, scripts/interactive.sh, scripts/verify.sh
- scripts/make-rootfs{,-void,-alpine}.sh
- scripts/register-{void,alpine}-image.sh
- scripts/make-{void,alpine}-kernel.sh
- internal/imagepreset/ (only consumer was `banger internal packages`,
  which fed customize.sh)
- examples/{void,alpine}.config.toml
- Makefile targets: rootfs, rootfs-void, rootfs-alpine, void-kernel,
  alpine-kernel, void-register, alpine-register, void-vm, alpine-vm,
  verify-void, verify-alpine, plus the ALPINE_RELEASE / *_IMAGE_NAME
  / *_VM_NAME variables

The void-6.12 kernel catalog entry is also gone — golden image pairs
with generic-6.12 and nothing else in the catalog depended on it.

Consolidated: imagemgr now holds the small DebianBasePackages list +
package-hash helper inline, so the `image build --from-image` flow
(still supported) no longer pulls from a separate imagepreset package.

Net: 3,815 lines deleted, 59 added. No runtime functionality removed
beyond the `banger internal packages` subcommand (hidden, used only
by the deleted customize.sh).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/kernel-catalog.md

@@ -36,13 +36,8 @@ traversal entries and unsafe symlinks are rejected.
 **`generic-<version>`** — built from upstream kernel.org sources with
 Firecracker's official config. All essential drivers (virtio_blk,
 virtio_net, ext4, vsock) compiled in — no modules, no initramfs. This
-is the recommended kernel for OCI-pulled images (Debian, Ubuntu,
-Fedora, etc.). Build with `scripts/make-generic-kernel.sh`.
-
-**`void-<version>` / `alpine-<version>`** — distro-specific kernels
-built from Void/Alpine package repos. Include initramfs + modules.
-These are for the `make rootfs-void` / `make rootfs-alpine` manual
-flows where the initramfs is paired with its matching rootfs.
+is the kernel the golden image pairs with and the recommended kernel
+for OCI-pulled images. Build with `scripts/make-generic-kernel.sh`.
 
 ## Adding or updating an entry
 
@@ -50,8 +45,8 @@ The repo has no CI for kernel publishing yet. Catalog updates are manual
 and infrequent (kernel version bumps every few weeks at most).
 
 ```bash
-# 1. Build the kernel locally with the existing helper.
-scripts/make-generic-kernel.sh   # or: make void-kernel / make alpine-kernel
+# 1. Build the kernel locally.
+scripts/make-generic-kernel.sh
 
 # 2. Import it into the local catalog so the canonical layout exists.
 banger kernel import generic-6.12 \
@@ -129,26 +124,11 @@ If hosting ever moves, catalog entries can be migrated by reuploading the
 tarballs and editing the URLs in `catalog.json` — no other code changes
 required.
 
-## Tech debt: kernel-build scripts
+## Tech debt
 
-`scripts/make-void-kernel.sh` and `scripts/make-alpine-kernel.sh` are
-procedural bash that fetches and patches per-distro kernel sources.
-Each new distro means a new bespoke script. They're "good enough"
-because catalog refreshes are infrequent and only the maintainer runs
-them, but they are the bottleneck if the catalog ever wants to grow
-beyond two distros.
-
-A future iteration should:
-
-- Move kernel acquisition into a Go (or at least uniform) tool with a
-  per-distro plugin/config rather than per-distro scripts.
-- Encode kernel config and required modules declaratively so a Debian
-  or Fedora target is a config addition, not a new script.
-- Run unattended in CI once banger goes public — the manual
-  `scripts/publish-kernel.sh` flow scales until then.
-
-Until that happens, `make lint-shell` only runs at `--severity=error`.
-Tightening to `--severity=warning` would surface real issues in the
-legacy build scripts (mostly `sudo cat > file` redirects and
-heredoc-quoting concerns); fixing those is a prerequisite to bumping
-the lint floor.
+- Kernel publishing is manual; there is no CI yet. `scripts/make-generic-kernel.sh`
+  plus `scripts/publish-kernel.sh` is fine while refreshes are
+  infrequent and maintainer-only. CI becomes relevant once banger
+  goes public.
+- `make lint-shell` runs at `--severity=error` only. Tightening to
+  `--severity=warning` is a nice-to-have but low priority.