Remove image build --from-image; doctor treats catalog images as OK

The `image build` flow spun up a transient Firecracker VM, SSHed in,
and ran a large bash provisioning script to derive a new managed
image from an existing one. It overlapped heavily with the golden-
image Dockerfile flow (same mise/docker/tmux/opencode install logic
duplicated in Go as `imagemgr.BuildProvisionScript`) and had far more
machinery: async op state, RPC begin/status/cancel, webui form +
operation page, preflight checks, API types, tests. For custom
images, writing a Dockerfile is simpler and more reproducible.

Removed end-to-end:
- CLI `image build` subcommand + `absolutizeImageBuildPaths`.
- Daemon: BuildImage method, imagebuild.go (transient-VM orchestration),
  image_build_ops.go (async begin/status/cancel), imagemgr/build.go
  (the 247-line provisioning script generator and all its append*
  helpers), validateImageBuildPrereqs + addImageBuildPrereqs.
- RPC dispatches for image.build / .begin / .status / .cancel.
- opstate registry `imageBuildOps`, daemon seam `imageBuild`,
  background pruner call.
- API types: ImageBuildParams, ImageBuildOperation, ImageBuildBeginResult,
  ImageBuildStatusParams, ImageBuildStatusResult; model type
  ImageBuildRequest.
- Web UI: Backend interface methods, handlers, form, routes, template
  branches (images.html build form, operation.html build branch,
  dashboard.html Build button).
- Tests that directly exercised BuildImage.

Doctor polish (task C):
- Drop the "image build" preflight section entirely (its raison d'être
  is gone).
- Default-image check now accepts "not local but in imagecat" as OK:
  vm create auto-pulls on first use. Only flag when the image is
  neither locally registered nor in the catalog.

Net: 24 files touched, 1,373 lines deleted, 25 added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/doctor.go

@@ -2,10 +2,10 @@ package daemon
 
 import (
 	"context"
-	"database/sql"
 	"strings"
 
 	"banger/internal/config"
+	"banger/internal/imagecat"
 	"banger/internal/model"
 	"banger/internal/paths"
 	"banger/internal/store"
@@ -41,7 +41,6 @@ func (d *Daemon) doctorReport(ctx context.Context) system.Report {
 	report.AddPreflight("core vm lifecycle", d.coreVMLifecycleChecks(), "required host tools available")
 	report.AddPreflight("vsock guest agent", d.vsockChecks(), "vsock guest agent prerequisites available")
 	d.addCapabilityDoctorChecks(ctx, &report)
-	report.AddPreflight("image build", d.imageBuildChecks(ctx), "image build prerequisites available")
 
 	return report
 }
@@ -56,44 +55,38 @@ func (d *Daemon) runtimeChecks() *system.Preflight {
 		checks.Addf("%v", err)
 	}
 	if d.store != nil && strings.TrimSpace(d.config.DefaultImageName) != "" {
-		image, err := d.store.GetImageByName(context.Background(), d.config.DefaultImageName)
-		switch {
-		case err == nil:
+		name := d.config.DefaultImageName
+		image, err := d.store.GetImageByName(context.Background(), name)
+		if err == nil {
 			checks.RequireFile(image.RootfsPath, "default image rootfs", `re-register or rebuild the default image`)
 			checks.RequireFile(image.KernelPath, "default image kernel", `re-register or rebuild the default image`)
 			if strings.TrimSpace(image.InitrdPath) != "" {
 				checks.RequireFile(image.InitrdPath, "default image initrd", `re-register or rebuild the default image`)
 			}
-		case err != nil && err != sql.ErrNoRows:
-			checks.Addf("failed to inspect default image %q: %v", d.config.DefaultImageName, err)
-		default:
-			checks.Addf("default image %q is not registered", d.config.DefaultImageName)
+		} else if !defaultImageInCatalog(name) {
+			checks.Addf("default image %q is not registered and not in the imagecat catalog", name)
 		}
+		// If the default image isn't local but is cataloged, vm create
+		// will auto-pull it on first use — no error to surface.
 	}
 	return checks
 }
 
+func defaultImageInCatalog(name string) bool {
+	catalog, err := imagecat.LoadEmbedded()
+	if err != nil {
+		return false
+	}
+	_, err = catalog.Lookup(name)
+	return err == nil
+}
+
 func (d *Daemon) coreVMLifecycleChecks() *system.Preflight {
 	checks := system.NewPreflight()
 	d.addBaseStartCommandPrereqs(checks)
 	return checks
 }
 
-func (d *Daemon) imageBuildChecks(ctx context.Context) *system.Preflight {
-	checks := system.NewPreflight()
-	if d.store == nil || strings.TrimSpace(d.config.DefaultImageName) == "" {
-		checks.Addf("default image is not available for build inheritance")
-		return checks
-	}
-	image, err := d.store.GetImageByName(ctx, d.config.DefaultImageName)
-	if err != nil {
-		checks.Addf("default image %q is not registered", d.config.DefaultImageName)
-		return checks
-	}
-	d.addImageBuildPrereqs(ctx, checks, image.RootfsPath, image.KernelPath, image.InitrdPath, image.ModulesDir, "")
-	return checks
-}
-
 func (d *Daemon) vsockChecks() *system.Preflight {
 	checks := system.NewPreflight()
 	if helper, err := d.vsockAgentBinary(); err == nil {