Remove image build --from-image; doctor treats catalog images as OK

The `image build` flow spun up a transient Firecracker VM, SSHed in,
and ran a large bash provisioning script to derive a new managed
image from an existing one. It overlapped heavily with the golden-
image Dockerfile flow (same mise/docker/tmux/opencode install logic
duplicated in Go as `imagemgr.BuildProvisionScript`) and had far more
machinery: async op state, RPC begin/status/cancel, webui form +
operation page, preflight checks, API types, tests. For custom
images, writing a Dockerfile is simpler and more reproducible.

Removed end-to-end:
- CLI `image build` subcommand + `absolutizeImageBuildPaths`.
- Daemon: BuildImage method, imagebuild.go (transient-VM orchestration),
  image_build_ops.go (async begin/status/cancel), imagemgr/build.go
  (the 247-line provisioning script generator and all its append*
  helpers), validateImageBuildPrereqs + addImageBuildPrereqs.
- RPC dispatches for image.build / .begin / .status / .cancel.
- opstate registry `imageBuildOps`, daemon seam `imageBuild`,
  background pruner call.
- API types: ImageBuildParams, ImageBuildOperation, ImageBuildBeginResult,
  ImageBuildStatusParams, ImageBuildStatusResult; model type
  ImageBuildRequest.
- Web UI: Backend interface methods, handlers, form, routes, template
  branches (images.html build form, operation.html build branch,
  dashboard.html Build button).
- Tests that directly exercised BuildImage.

Doctor polish (task C):
- Drop the "image build" preflight section entirely (its raison d'être
  is gone).
- Default-image check now accepts "not local but in imagecat" as OK:
  vm create auto-pulls on first use. Only flag when the image is
  neither locally registered nor in the catalog.

Net: 24 files touched, 1,373 lines deleted, 25 added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/daemon.go

@@ -38,7 +38,6 @@ type Daemon struct {
 	imageOpsMu               sync.Mutex
 	createVMMu               sync.Mutex
 	createOps                opstate.Registry[*vmCreateOperationState]
-	imageBuildOps            opstate.Registry[*imageBuildOperationState]
 	vmLocks                  vmLockSet
 	sessions                 sessionRegistry
 	tapPool                  tapPool
@@ -51,7 +50,6 @@ type Daemon struct {
 	webURL                   string
 	vmDNS                    *vmdns.Server
 	vmCaps                   []vmCapability
-	imageBuild               func(context.Context, imageBuildSpec) error
 	pullAndFlatten           func(ctx context.Context, ref, cacheDir, destDir string) (imagepull.Metadata, error)
 	finalizePulledRootfs     func(ctx context.Context, ext4File string, meta imagepull.Metadata) error
 	bundleFetch              func(ctx context.Context, destDir string, entry imagecat.CatEntry) (imagecat.Manifest, error)
@@ -483,34 +481,6 @@ func (d *Daemon) dispatch(ctx context.Context, req rpc.Request) rpc.Response {
 		}
 		image, err := d.FindImage(ctx, params.IDOrName)
 		return marshalResultOrError(api.ImageShowResult{Image: image}, err)
-	case "image.build":
-		params, err := rpc.DecodeParams[api.ImageBuildParams](req)
-		if err != nil {
-			return rpc.NewError("bad_request", err.Error())
-		}
-		image, err := d.BuildImage(ctx, params)
-		return marshalResultOrError(api.ImageShowResult{Image: image}, err)
-	case "image.build.begin":
-		params, err := rpc.DecodeParams[api.ImageBuildParams](req)
-		if err != nil {
-			return rpc.NewError("bad_request", err.Error())
-		}
-		op, err := d.BeginImageBuild(ctx, params)
-		return marshalResultOrError(api.ImageBuildBeginResult{Operation: op}, err)
-	case "image.build.status":
-		params, err := rpc.DecodeParams[api.ImageBuildStatusParams](req)
-		if err != nil {
-			return rpc.NewError("bad_request", err.Error())
-		}
-		op, err := d.ImageBuildStatus(ctx, params.ID)
-		return marshalResultOrError(api.ImageBuildStatusResult{Operation: op}, err)
-	case "image.build.cancel":
-		params, err := rpc.DecodeParams[api.ImageBuildStatusParams](req)
-		if err != nil {
-			return rpc.NewError("bad_request", err.Error())
-		}
-		err = d.CancelImageBuild(ctx, params.ID)
-		return marshalResultOrError(api.Empty{}, err)
 	case "image.register":
 		params, err := rpc.DecodeParams[api.ImageRegisterParams](req)
 		if err != nil {
@@ -594,7 +564,6 @@ func (d *Daemon) backgroundLoop() {
 				d.logger.Error("background stale sweep failed", "error", err.Error())
 			}
 			d.pruneVMCreateOperations(time.Now().Add(-10 * time.Minute))
-			d.pruneImageBuildOperations(time.Now().Add(-10 * time.Minute))
 		}
 	}
 }