Add vsock-backed VM port inspection

Let the host ask the guest vsock agent to run ss so open ports can be surfaced without SSHing in manually.

Add a narrow /ports agent endpoint, a daemon vm.ports RPC that enriches listeners with <hostname>.vm endpoints and best-effort HTTP links, and a concurrent 'banger vm ports' CLI table for one or more VMs.

Update the guest package contract to include ss for rebuilt Debian images, allow the guest agent package in the shell-out policy, and cover the new parsing/RPC/CLI flow in tests.

Verified with GOCACHE=/tmp/banger-gocache go test ./... outside the sandbox, make build, bash -n customize.sh make-rootfs-void.sh verify.sh, and ./banger vm ports --help.

internal/cli/cli_test.go

@@ -151,6 +151,17 @@ func TestVMKillFlagsExist(t *testing.T) {
 	}
 }
 
+func TestVMPortsCommandExists(t *testing.T) {
+	root := NewBangerCommand()
+	vm, _, err := root.Find([]string{"vm"})
+	if err != nil {
+		t.Fatalf("find vm: %v", err)
+	}
+	if _, _, err := vm.Find([]string{"ports"}); err != nil {
+		t.Fatalf("find ports: %v", err)
+	}
+}
+
 func TestVMSetParamsFromFlags(t *testing.T) {
 	params, err := vmSetParamsFromFlags("devbox", 4, 2048, "16G", true, false)
 	if err != nil {
@@ -268,6 +279,59 @@ func TestAbsolutizeImageRegisterPaths(t *testing.T) {
 	}
 }
 
+func TestPrintVMPortsTableSortsAndRendersURLs(t *testing.T) {
+	results := []vmPortsBatchResult{
+		{
+			Target: resolvedVMTarget{Ref: "beta"},
+			Result: api.VMPortsResult{
+				Name: "beta",
+				Ports: []api.VMPort{{
+					Proto:    "tcp",
+					Port:     8080,
+					Endpoint: "beta.vm:8080",
+					Process:  "python3",
+					Command:  "python3 -m http.server 8080",
+					WebURL:   "http://beta.vm:8080/",
+				}},
+			},
+		},
+		{
+			Target: resolvedVMTarget{Ref: "alpha"},
+			Result: api.VMPortsResult{
+				Name: "alpha",
+				Ports: []api.VMPort{{
+					Proto:    "udp",
+					Port:     53,
+					Endpoint: "alpha.vm:53",
+					Process:  "dnsd",
+					Command:  "dnsd --foreground",
+				}},
+			},
+		},
+	}
+
+	var out bytes.Buffer
+	if err := printVMPortsTable(&out, results); err != nil {
+		t.Fatalf("printVMPortsTable: %v", err)
+	}
+	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("lines = %q, want header + 2 rows", lines)
+	}
+	if !strings.Contains(lines[0], "VM") || !strings.Contains(lines[0], "WEB") {
+		t.Fatalf("header = %q, want VM/WEB columns", lines[0])
+	}
+	if !strings.Contains(lines[1], "alpha") || !strings.Contains(lines[1], "alpha.vm:53") || !strings.Contains(lines[1], "\t-\n") {
+		// tabwriter output is space-expanded, so just require the dash placeholder.
+		if !strings.Contains(lines[1], "alpha") || !strings.Contains(lines[1], "alpha.vm:53") || !strings.HasSuffix(strings.TrimSpace(lines[1]), "-") {
+			t.Fatalf("first row = %q, want alpha row with dash web column", lines[1])
+		}
+	}
+	if !strings.Contains(lines[2], "beta") || !strings.Contains(lines[2], "http://beta.vm:8080/") {
+		t.Fatalf("second row = %q, want beta web url", lines[2])
+	}
+}
+
 func TestRunSSHSessionPrintsReminderWhenHealthCheckPasses(t *testing.T) {
 	origSSHExec := sshExecFunc
 	origHealth := vmHealthFunc