imagecat: publish debian-bookworm golden image

First entry in the image catalog. Verified end-to-end:
  - https://images.thaloco.com/debian-bookworm-x86_64.tar.zst reachable
  - sha256 071495e6... matches
  - bundle unpacks to rootfs.ext4 (4 GiB) + manifest.json with the
    expected name/distro/arch/kernel_ref.

publish-golden-image.sh tweaks:
  - default RCLONE_REMOTE from 'r2' to 'banger-images' (matches the
    rclone config actually in use here).
  - rclone copyto now passes --s3-no-check-bucket and --no-check-dest
    so scoped R2 tokens without HeadBucket/HeadObject permission
    still upload cleanly.

To use: restart bangerd so it picks up the new embedded catalog,
then `banger image pull debian-bookworm`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/imagecat/catalog.json

@@ -1,4 +1,14 @@
 {
   "version": 1,
-  "entries": []
+  "entries": [
+    {
+      "name": "debian-bookworm",
+      "distro": "debian",
+      "arch": "x86_64",
+      "kernel_ref": "generic-6.12",
+      "tarball_url": "https://images.thaloco.com/debian-bookworm-x86_64.tar.zst",
+      "tarball_sha256": "071495e60e830d5a0b40bb7b227a40a81cc0631a99d79a4eae471166b0d69a53",
+      "size_bytes": 286026738
+    }
+  ]
 }