daemon split (2/5): extract *ImageService service

Second phase of splitting the daemon god-struct. ImageService now owns
all image + kernel registry operations: register/promote/delete/pull
for images (bundle + OCI paths), the six kernel commands, and the
shared SSH-key/work-seed injection helpers. imageOpsMu (the
publication-window lock) lives on the service; so do the three OCI
pull test seams pullAndFlatten / finalizePulledRootfs / bundleFetch.
The four files images.go, images_pull.go, image_seed.go, kernels.go
flipped their receivers from *Daemon to *ImageService.

FindImage moved with the service. Daemon keeps a thin FindImage
forwarder so callers reading the dispatch code see the obvious
facade and tests that pre-date the split still compile.

flattenNestedWorkHome — called from image_seed.go, vm_authsync.go,
and vm_disk.go across future service boundaries — became a
package-level helper taking a CommandRunner explicitly. Daemon keeps
a deprecated forwarder for now; the other services will use the
package form.

Lazy-init helper imageSvc() on Daemon mirrors hostNet() from
Phase 1, so test literals like &Daemon{store: db, runner: r, ...}
that don't spell out an ImageService still get a working one.
Tests that override the image test seams (autopull_test,
concurrency_test, images_pull_test, images_pull_bundle_test) now
assign d.img = &ImageService{...seams...}; the two-statement pattern
matches what Phase 1 established for HostNetwork.

Dispatch in daemon.go is cleaner now: every image/kernel RPC handler
is a single-liner forwarding to d.imageSvc().*. Phase 5 will do the
same for VM lifecycle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/image_service.go

@@ -0,0 +1,129 @@
+package daemon
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+	"sync"
+
+	"banger/internal/imagecat"
+	"banger/internal/imagepull"
+	"banger/internal/model"
+	"banger/internal/paths"
+	"banger/internal/store"
+	"banger/internal/system"
+)
+
+// ImageService owns everything image-registry-related: register /
+// promote / delete / pull (bundle + OCI), plus the kernel catalog
+// operations that share the same lifecycle primitives. The publication
+// lock imageOpsMu lives here so its scope is obvious at the field
+// definition, and the three OCI-pull test seams (pullAndFlatten,
+// finalizePulledRootfs, bundleFetch) are fields on the service rather
+// than mutable globals on Daemon.
+//
+// Kept unexported except where peer services (VMService) need it, and
+// peer access goes through consumer-defined interfaces, not direct
+// struct poking.
+type ImageService struct {
+	runner system.CommandRunner
+	logger *slog.Logger
+	config model.DaemonConfig
+	layout paths.Layout
+	store  *store.Store
+
+	// imageOpsMu is the publication-window lock: held only across the
+	// "recheck name free + atomic rename + UpsertImage" commit. See
+	// internal/daemon/ARCHITECTURE.md.
+	imageOpsMu sync.Mutex
+
+	// Test seams; nil → real implementation.
+	pullAndFlatten       func(ctx context.Context, ref, cacheDir, destDir string) (imagepull.Metadata, error)
+	finalizePulledRootfs func(ctx context.Context, ext4File string, meta imagepull.Metadata) error
+	bundleFetch          func(ctx context.Context, destDir string, entry imagecat.CatEntry) (imagecat.Manifest, error)
+
+	// beginOperation is a test seam used by a couple of image ops that
+	// want structured operation logging. Nil → Daemon's beginOperation,
+	// injected at construction.
+	beginOperation func(name string, attrs ...any) *operationLog
+}
+
+// imageServiceDeps names every handle ImageService needs from the
+// Daemon composition root. Using a struct (rather than positional args)
+// makes the wiring site in Daemon.Open read as a declaration.
+type imageServiceDeps struct {
+	runner         system.CommandRunner
+	logger         *slog.Logger
+	config         model.DaemonConfig
+	layout         paths.Layout
+	store          *store.Store
+	beginOperation func(name string, attrs ...any) *operationLog
+}
+
+func newImageService(deps imageServiceDeps) *ImageService {
+	return &ImageService{
+		runner:         deps.runner,
+		logger:         deps.logger,
+		config:         deps.config,
+		layout:         deps.layout,
+		store:          deps.store,
+		beginOperation: deps.beginOperation,
+	}
+}
+
+// FindImage is the service-owned lookup helper. It falls back from
+// exact-name → exact-id → prefix match, matching the historical
+// daemon.FindImage behaviour. Kept on ImageService because image
+// lookup is inherently a service concern.
+func (s *ImageService) FindImage(ctx context.Context, idOrName string) (model.Image, error) {
+	if idOrName == "" {
+		return model.Image{}, fmt.Errorf("image id or name is required")
+	}
+	if image, err := s.store.GetImageByName(ctx, idOrName); err == nil {
+		return image, nil
+	}
+	if image, err := s.store.GetImageByID(ctx, idOrName); err == nil {
+		return image, nil
+	}
+	images, err := s.store.ListImages(ctx)
+	if err != nil {
+		return model.Image{}, err
+	}
+	matchCount := 0
+	var match model.Image
+	for _, image := range images {
+		if strings.HasPrefix(image.ID, idOrName) || strings.HasPrefix(image.Name, idOrName) {
+			match = image
+			matchCount++
+		}
+	}
+	if matchCount == 1 {
+		return match, nil
+	}
+	if matchCount > 1 {
+		return model.Image{}, fmt.Errorf("multiple images match %q", idOrName)
+	}
+	return model.Image{}, fmt.Errorf("image %q not found", idOrName)
+}
+
+// imageSvc is the Daemon-side getter that lazy-inits ImageService from
+// current Daemon fields. Mirrors hostNet() so test literals can keep
+// using `&Daemon{store: db, runner: r, ...}` and still end up with a
+// working ImageService.
+func (d *Daemon) imageSvc() *ImageService {
+	if d.img != nil {
+		return d.img
+	}
+	d.img = newImageService(imageServiceDeps{
+		runner: d.runner,
+		logger: d.logger,
+		config: d.config,
+		layout: d.layout,
+		store:  d.store,
+		beginOperation: func(name string, attrs ...any) *operationLog {
+			return d.beginOperation(name, attrs...)
+		},
+	})
+	return d.img
+}