Make runtime defaults portable

Stop assuming one workstation layout for runtime artifacts, mapdns, and host tooling. The daemon and shell helpers now use portable mapdns configuration, and runtime bundles can carry bundle.json metadata for their default kernel, initrd, modules, rootfs, and helper paths.

Load bundle metadata through config with a legacy layout fallback, thread mapdns_bin/mapdns_data_file through the Go and shell paths, and add command-scoped preflight checks for VM start, NAT, image build, work-disk resize, and SSH so missing tools or artifacts fail with actionable errors.

Update the runtime-bundle manifest, docs, and tests to match the new model. Verified with go test ./..., make build, and bash -n customize.sh interactive.sh dns.sh make-rootfs.sh verify.sh.

internal/cli/banger.go

@@ -121,6 +121,7 @@ func newVMCommand() *cobra.Command {
 		newVMShowCommand(),
 		newVMActionCommand("start", "Start a VM", "vm.start"),
 		newVMActionCommand("stop", "Stop a VM", "vm.stop"),
+		newVMKillCommand(),
 		newVMActionCommand("restart", "Restart a VM", "vm.restart"),
 		newVMActionCommand("delete", "Delete a VM", "vm.delete"),
 		newVMSetCommand(),
@@ -131,6 +132,35 @@ func newVMCommand() *cobra.Command {
 	return cmd
 }
 
+func newVMKillCommand() *cobra.Command {
+	var signal string
+	cmd := &cobra.Command{
+		Use:   "kill <id-or-name>",
+		Short: "Send a signal to a VM process",
+		Args:  exactArgsUsage(1, "usage: banger vm kill [--signal SIGTERM|SIGKILL|...] <id-or-name>"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if err := system.EnsureSudo(cmd.Context()); err != nil {
+				return err
+			}
+			layout, _, err := ensureDaemon(cmd.Context())
+			if err != nil {
+				return err
+			}
+			result, err := rpc.Call[api.VMShowResult](
+				cmd.Context(),
+				layout.SocketPath,
+				"vm.kill",
+				api.VMKillParams{IDOrName: args[0], Signal: signal},
+			)
+			if err != nil {
+				return err
+			}
+			return printVMSummary(cmd.OutOrStdout(), result.VM)
+		},
+	}
+	cmd.Flags().StringVar(&signal, "signal", "TERM", "signal name to send")
+	return cmd
+}
 
 func newVMCreateCommand() *cobra.Command {
 	var params api.VMCreateParams
@@ -290,6 +320,9 @@ func newVMSSHCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			if err := validateSSHPrereqs(cfg); err != nil {
+				return err
+			}
 			result, err := rpc.Call[api.VMSSHResult](cmd.Context(), layout.SocketPath, "vm.ssh", api.VMRefParams{IDOrName: args[0]})
 			if err != nil {
 				return err
@@ -643,6 +676,15 @@ func sshCommandArgs(cfg model.DaemonConfig, guestIP string, extra []string) ([]s
 	return args, nil
 }
 
+func validateSSHPrereqs(cfg model.DaemonConfig) error {
+	checks := system.NewPreflight()
+	checks.RequireCommand("ssh", "install openssh-client")
+	if strings.TrimSpace(cfg.SSHKeyPath) != "" {
+		checks.RequireFile(cfg.SSHKeyPath, "ssh private key", `set "ssh_key_path" or refresh the runtime bundle`)
+	}
+	return checks.Err("ssh preflight failed")
+}
+
 func absolutizeImageBuildPaths(params *api.ImageBuildParams) error {
 	var err error
 	for _, value := range []*string{&params.BaseRootfs, &params.KernelPath, &params.InitrdPath, &params.ModulesDir} {

internal/cli/cli_test.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strings"
 	"testing"
 
 	"banger/internal/api"
@@ -39,6 +40,20 @@ func TestVMCreateFlagsExist(t *testing.T) {
 	}
 }
 
+func TestVMKillFlagsExist(t *testing.T) {
+	root := NewBangerCommand()
+	vm, _, err := root.Find([]string{"vm"})
+	if err != nil {
+		t.Fatalf("find vm: %v", err)
+	}
+	kill, _, err := vm.Find([]string{"kill"})
+	if err != nil {
+		t.Fatalf("find kill: %v", err)
+	}
+	if kill.Flags().Lookup("signal") == nil {
+		t.Fatal("missing signal flag")
+	}
+}
 
 func TestVMSetParamsFromFlags(t *testing.T) {
 	params, err := vmSetParamsFromFlags("devbox", 4, 2048, "16G", true, false)
@@ -82,6 +97,25 @@ func TestSSHCommandArgs(t *testing.T) {
 	}
 }
 
+func TestValidateSSHPrereqs(t *testing.T) {
+	dir := t.TempDir()
+	keyPath := filepath.Join(dir, "id_ed25519")
+	if err := os.WriteFile(keyPath, []byte("key"), 0o600); err != nil {
+		t.Fatalf("write key: %v", err)
+	}
+
+	if err := validateSSHPrereqs(model.DaemonConfig{SSHKeyPath: keyPath}); err != nil {
+		t.Fatalf("validateSSHPrereqs: %v", err)
+	}
+}
+
+func TestValidateSSHPrereqsFailsForMissingKey(t *testing.T) {
+	err := validateSSHPrereqs(model.DaemonConfig{SSHKeyPath: "/does/not/exist"})
+	if err == nil || !strings.Contains(err.Error(), "ssh private key") {
+		t.Fatalf("validateSSHPrereqs() error = %v, want missing key", err)
+	}
+}
+
 func TestNewBangerdCommandRejectsArgs(t *testing.T) {
 	cmd := NewBangerdCommand()
 	cmd.SetArgs([]string{"extra"})

internal/cli/tui.go

@@ -1155,6 +1155,9 @@ func deleteActionCmd(layout paths.Layout, action actionRequest) tea.Cmd {
 
 func prepareSSHCmd(layout paths.Layout, cfg model.DaemonConfig, action actionRequest) tea.Cmd {
 	return func() tea.Msg {
+		if err := validateSSHPrereqs(cfg); err != nil {
+			return externalPreparedMsg{action: action, err: err}
+		}
 		result, err := rpc.Call[api.VMSSHResult](context.Background(), layout.SocketPath, "vm.ssh", api.VMRefParams{IDOrName: action.id})
 		if err != nil {
 			return externalPreparedMsg{action: action, err: err}