Phase 1: local kernel catalog scaffolding

Introduces a read/write kernel catalog on disk without any network
dependency, so later phases (image register --kernel-ref, import, pull)
can build on a working foundation.

Layout: adds KernelsDir to paths.Layout, ensured under
~/.local/state/banger/kernels/. Each cataloged kernel lives at
<KernelsDir>/<name>/ with a manifest.json alongside vmlinux and optional
initrd.img / modules/.

New internal/kernelcat package owns the disk format:
- Entry (Name, Distro, Arch, KernelVersion, SHA256, Source, ImportedAt)
- ValidateName (alphanumeric + dots/hyphens/underscores, no traversal)
- ReadLocal / ListLocal / WriteLocal / DeleteLocal
- SumFile helper

The daemon exposes three RPC methods dispatched in daemon.go:
kernel.list, kernel.show, kernel.delete. Implementations live in a new
internal/daemon/kernels.go and are thin wrappers over kernelcat using
d.layout.KernelsDir.

CLI: new top-level `banger kernel` with list / show / rm subcommands
mirroring the image-command pattern (ensureDaemon, RPC call, table or
JSON output). No sudo required — kernel ops are user-space only.

Users can now manually populate ~/.local/state/banger/kernels/<name>/
and see it via `banger kernel list`. Phase 2 wires --kernel-ref into
image register; Phase 3 adds `banger kernel import`; Phase 4 adds
remote pulls.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/daemon/daemon.go

@@ -527,6 +527,22 @@ func (d *Daemon) dispatch(ctx context.Context, req rpc.Request) rpc.Response {
 		}
 		image, err := d.DeleteImage(ctx, params.IDOrName)
 		return marshalResultOrError(api.ImageShowResult{Image: image}, err)
+	case "kernel.list":
+		return marshalResultOrError(d.KernelList(ctx))
+	case "kernel.show":
+		params, err := rpc.DecodeParams[api.KernelRefParams](req)
+		if err != nil {
+			return rpc.NewError("bad_request", err.Error())
+		}
+		entry, err := d.KernelShow(ctx, params.Name)
+		return marshalResultOrError(api.KernelShowResult{Entry: entry}, err)
+	case "kernel.delete":
+		params, err := rpc.DecodeParams[api.KernelRefParams](req)
+		if err != nil {
+			return rpc.NewError("bad_request", err.Error())
+		}
+		err = d.KernelDelete(ctx, params.Name)
+		return marshalResultOrError(api.Empty{}, err)
 	default:
 		return rpc.NewError("unknown_method", req.Method)
 	}

internal/daemon/kernels.go

@@ -0,0 +1,67 @@
+package daemon
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"banger/internal/api"
+	"banger/internal/kernelcat"
+)
+
+func (d *Daemon) KernelList(_ context.Context) (api.KernelListResult, error) {
+	entries, err := kernelcat.ListLocal(d.layout.KernelsDir)
+	if err != nil {
+		return api.KernelListResult{}, err
+	}
+	result := api.KernelListResult{Entries: make([]api.KernelEntry, 0, len(entries))}
+	for _, entry := range entries {
+		result.Entries = append(result.Entries, kernelEntryToAPI(entry))
+	}
+	return result, nil
+}
+
+func (d *Daemon) KernelShow(_ context.Context, name string) (api.KernelEntry, error) {
+	entry, err := kernelcat.ReadLocal(d.layout.KernelsDir, name)
+	if err != nil {
+		return api.KernelEntry{}, kernelNotFoundIfMissing(name, err)
+	}
+	return kernelEntryToAPI(entry), nil
+}
+
+func (d *Daemon) KernelDelete(_ context.Context, name string) error {
+	if err := kernelcat.ValidateName(name); err != nil {
+		return err
+	}
+	return kernelcat.DeleteLocal(d.layout.KernelsDir, name)
+}
+
+func kernelEntryToAPI(entry kernelcat.Entry) api.KernelEntry {
+	importedAt := ""
+	if !entry.ImportedAt.IsZero() {
+		importedAt = entry.ImportedAt.UTC().Format(time.RFC3339)
+	}
+	return api.KernelEntry{
+		Name:          entry.Name,
+		Distro:        entry.Distro,
+		Arch:          entry.Arch,
+		KernelVersion: entry.KernelVersion,
+		SHA256:        entry.SHA256,
+		Source:        entry.Source,
+		ImportedAt:    importedAt,
+		KernelPath:    entry.KernelPath,
+		InitrdPath:    entry.InitrdPath,
+		ModulesDir:    entry.ModulesDir,
+	}
+}
+
+func kernelNotFoundIfMissing(name string, err error) error {
+	if err == nil {
+		return nil
+	}
+	if os.IsNotExist(err) {
+		return fmt.Errorf("kernel %q not found", name)
+	}
+	return err
+}

internal/daemon/kernels_test.go

@@ -0,0 +1,99 @@
+package daemon
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"banger/internal/api"
+	"banger/internal/kernelcat"
+	"banger/internal/paths"
+	"banger/internal/rpc"
+)
+
+func seedKernelEntry(t *testing.T, kernelsDir, name string) {
+	t.Helper()
+	entry := kernelcat.Entry{
+		Name:          name,
+		Distro:        "void",
+		Arch:          "x86_64",
+		KernelVersion: "6.12.0",
+		Source:        "test",
+	}
+	if err := kernelcat.WriteLocal(kernelsDir, entry); err != nil {
+		t.Fatalf("seed WriteLocal: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(kernelsDir, name, "vmlinux"), []byte("kernel-bytes"), 0o644); err != nil {
+		t.Fatalf("seed vmlinux: %v", err)
+	}
+}
+
+func TestKernelListReturnsSeededEntries(t *testing.T) {
+	kernelsDir := t.TempDir()
+	seedKernelEntry(t, kernelsDir, "void-6.12")
+	seedKernelEntry(t, kernelsDir, "alpine-3.23")
+
+	d := &Daemon{layout: paths.Layout{KernelsDir: kernelsDir}}
+	result, err := d.KernelList(context.Background())
+	if err != nil {
+		t.Fatalf("KernelList: %v", err)
+	}
+	if len(result.Entries) != 2 {
+		t.Fatalf("entries = %d, want 2", len(result.Entries))
+	}
+	// sorted alphabetically by kernelcat
+	if result.Entries[0].Name != "alpine-3.23" || result.Entries[1].Name != "void-6.12" {
+		t.Fatalf("entries order = %+v", result.Entries)
+	}
+	if result.Entries[0].KernelPath == "" || !strings.HasSuffix(result.Entries[0].KernelPath, "vmlinux") {
+		t.Fatalf("KernelPath not populated: %+v", result.Entries[0])
+	}
+}
+
+func TestKernelShowAndDeleteThroughDispatch(t *testing.T) {
+	kernelsDir := t.TempDir()
+	seedKernelEntry(t, kernelsDir, "void-6.12")
+
+	d := &Daemon{layout: paths.Layout{KernelsDir: kernelsDir}}
+
+	showParams, _ := json.Marshal(api.KernelRefParams{Name: "void-6.12"})
+	resp := d.dispatch(context.Background(), rpc.Request{Version: rpc.Version, Method: "kernel.show", Params: showParams})
+	if !resp.OK {
+		t.Fatalf("kernel.show dispatch failed: %+v", resp)
+	}
+	var show api.KernelShowResult
+	if err := json.Unmarshal(resp.Result, &show); err != nil {
+		t.Fatalf("unmarshal show: %v", err)
+	}
+	if show.Entry.Name != "void-6.12" || show.Entry.Distro != "void" {
+		t.Fatalf("show.Entry = %+v", show.Entry)
+	}
+
+	delParams, _ := json.Marshal(api.KernelRefParams{Name: "void-6.12"})
+	del := d.dispatch(context.Background(), rpc.Request{Version: rpc.Version, Method: "kernel.delete", Params: delParams})
+	if !del.OK {
+		t.Fatalf("kernel.delete dispatch failed: %+v", del)
+	}
+
+	if _, err := kernelcat.ReadLocal(kernelsDir, "void-6.12"); !os.IsNotExist(err) {
+		t.Fatalf("entry still present after delete: err=%v", err)
+	}
+}
+
+func TestKernelShowMissingEntry(t *testing.T) {
+	d := &Daemon{layout: paths.Layout{KernelsDir: t.TempDir()}}
+	_, err := d.KernelShow(context.Background(), "nope")
+	if err == nil || !strings.Contains(err.Error(), "not found") {
+		t.Fatalf("KernelShow missing: err=%v", err)
+	}
+}
+
+func TestKernelDeleteRejectsInvalidName(t *testing.T) {
+	d := &Daemon{layout: paths.Layout{KernelsDir: t.TempDir()}}
+	if err := d.KernelDelete(context.Background(), "../escape"); err == nil {
+		t.Fatalf("KernelDelete should reject traversal")
+	}
+}