Add lint targets, fix gofmt drift, broaden Makefile build inputs

Three small operational improvements.

1. Makefile build dependencies now cover everything under cmd/ and
   internal/, not just *.go. The previous GO_SOURCES find pattern
   missed embedded assets (catalog.json today, anything else added
   later), so editing a JSON manifest didn't trigger a rebuild and
   left the binary stale. New BUILD_INPUTS covers all files; go's own
   build cache absorbs any redundant invocations. GO_SOURCES is kept
   for fmt/lint targets which still want only Go files.

2. New `make lint` (default + lint-go + lint-shell):
   - lint-go: gofmt -l (fail if any output) and go vet ./...
   - lint-shell: shellcheck --severity=error on scripts/*.sh
   The shell floor is set at error-level for now; the legacy
   make-rootfs-*.sh / make-*-kernel.sh / customize.sh scripts have
   warning-level findings (sudo-cat redirects, heredoc quoting) that
   would block landing this if we tightened immediately. Documented
   as tech debt in docs/kernel-catalog.md alongside a note about
   eventually replacing the per-distro bash with a uniform Go tool.

3. gofmt drift fixed in internal/daemon/imagemgr/build.go,
   session/session.go, and vm_create_ops.go (trailing newline +
   gofmt's preferred function-definition wrapping). Now
   `make lint` passes cleanly; future drift will fail CI/local lint
   instead of accumulating.

AGENTS.md gains a one-line note on make lint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/kernel-catalog.md

@@ -115,3 +115,27 @@ never committed). R2's free tier covers the expected traffic comfortably
 If hosting ever moves, catalog entries can be migrated by reuploading the
 tarballs and editing the URLs in `catalog.json` — no other code changes
 required.
+
+## Tech debt: kernel-build scripts
+
+`scripts/make-void-kernel.sh` and `scripts/make-alpine-kernel.sh` are
+procedural bash that fetches and patches per-distro kernel sources.
+Each new distro means a new bespoke script. They're "good enough"
+because catalog refreshes are infrequent and only the maintainer runs
+them, but they are the bottleneck if the catalog ever wants to grow
+beyond two distros.
+
+A future iteration should:
+
+- Move kernel acquisition into a Go (or at least uniform) tool with a
+  per-distro plugin/config rather than per-distro scripts.
+- Encode kernel config and required modules declaratively so a Debian
+  or Fedora target is a config addition, not a new script.
+- Run unattended in CI once banger goes public — the manual
+  `scripts/publish-kernel.sh` flow scales until then.
+
+Until that happens, `make lint-shell` only runs at `--severity=error`.
+Tightening to `--severity=warning` would surface real issues in the
+legacy build scripts (mostly `sudo cat > file` redirects and
+heredoc-quoting concerns); fixing those is a prerequisite to bumping
+the lint floor.