E2E'd `forkd quickstart` end-to-end in an isolated privileged container
(host networking untouched). It crashed at six distinct points before a
clean run — every one a wall a new user hits in their first minute:

1. **install-guest-kernel.sh hardcodes `sudo`** — absent in minimal
   environments (containers, slim images) where quickstart already runs
   as root. Added a `$(id -u)==0 ? "" : "sudo"` shim.
2. **`file`/`strings` assumed present** in the same script's post-install
   descriptor lines — guarded with `command -v`.
3. **`$USER` unbound under `set -u`** in host-tap.sh + netns-setup.sh
   (unset in `docker exec` / non-login shells). Fall back through
   `id -un`.
4. **unpack baked the packing host's absolute paths** into snapshot.json,
   so the first restore on any other machine failed with FC's "Failed to
   open snapshot file". `hub::unpack` now rewrites `vmstate`/`memory` to
   the extraction dir; main.rs re-runs the rewrite AFTER the staging→final
   `rename(2)` (v1 and v2 chain paths) since the in-unpack pass points at
   the soon-stale staging dir. Operates on `serde_json::Value` so unknown
   fields and volume paths survive. Two unit tests.
5. **build-rootfs.sh hardcodes `sudo`** at 18 sites — same shim.
6. **tarball installs can't find `scripts/` or `rootfs-init/`** — the
   `from-image` bake shells out to build-rootfs.sh, which finds the guest
   init+agent via `$(dirname $0)/../rootfs-init`. quickstart now stages
   the embedded scripts as `<base>/scripts/*` with the init files in the
   sibling `<base>/rootfs-init/` and points FORKD_SCRIPTS_DIR there.
   Without this the guest booted with no init → `Kernel panic … init
   /forkd-init.sh failed (error -2)` → FC exits → pause fails.

Also: doctor::preflight() softens the three non-gating rows (kernel/tap/
docker) from ✗ to ⚠ — a red ✗ immediately followed by "quickstart sets
this up" read as a contradiction.

Clean run now: preflight 7✓ → consent heal → docker bake (5.3 s snapshot)
→ fork 4 children in 59 ms wall-clock, 4/4 alive. Transcript saved.

Note: the hub-pull fallback path surfaced a separate, deeper portability
bug (snapshots aren't relocatable across hosts — rootfs absolute path in
the vmstate + rootfs not shipped in packs); filed as #242. quickstart's
preferred local-bake path is unaffected and prints a warning before the
hub fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>