Make installed banger self-contained

Fix the misleading make install path where banger and bangerd still depended on a repo checkout for Firecracker, guest artifacts, image builds, and the SSH key.

Replace repo-root inference with an explicit runtime bundle model: resolve a runtime_dir from env/config/install layout, derive concrete artifact paths from it, and update the daemon, CLI, and image-build flow to use those paths. Keep repo_root only as an explicit compatibility alias instead of auto-detecting it.

Teach customize.sh to run from a read-only bundled runtime tree while writing transient state under XDG/BANGER_STATE_DIR, and make make install copy the runtime assets into PREFIX/lib/banger so installed binaries stay usable outside the repo.

Validate with go test ./..., make build, bash -n customize.sh, and make install DESTDIR=/tmp/banger-install PREFIX=/usr. An out-of-repo installed-binary smoke test was attempted, but this sandbox blocked bangerd from binding its Unix socket (setsockopt: operation not permitted).

internal/model/types.go

@@ -35,7 +35,11 @@ const (
 )
 
 type DaemonConfig struct {
-	RepoRoot            string
+	RuntimeDir          string
+	FirecrackerBin      string
+	SSHKeyPath          string
+	NamegenPath         string
+	CustomizeScript     string
 	AutoStopStaleAfter  time.Duration
 	StatsPollInterval   time.Duration
 	MetricsPollInterval time.Duration
@@ -44,6 +48,7 @@ type DaemonConfig struct {
 	CIDR                string
 	DefaultDNS          string
 	DefaultImageName    string
+	DefaultRootfs       string
 	DefaultBaseRootfs   string
 	DefaultKernel       string
 	DefaultInitrd       string