Harden curated image builds

[nueces]

Summary

• Replace sbx image build-debian with sbx image build.
• Build one curated Debian/Pi/rootless-Docker image by default.
• Store the default image at ~/.smolvm/images/sbx.
• Download kernel build inputs from immutable SmolVM and Moby commits.
• Verify every downloaded input with an individually pinned SHA-256 before use.
• Skip the unused SmolVM prebuilt-kernel download.
• Omit the SmolVM guest agent and use SSH exclusively for local images.
• Standardize newly built kernels as vmlinux.bin.
• Update completions, tests, documentation, and specifications.

Supply-chain security

The image builder downloads seven upstream build inputs:

• Six SmolVM kernel recipe files.
• Moby’s check-config.sh.

Each input:

• uses a full immutable commit URL;
• has an independently pinned SHA-256;
• is verified before being copied, modified, mounted into Docker, or executed;
• has no configurable URL, fallback mirror, or verification bypass.

The SmolVM recipe and Moby checker are not redistributed in the sbx wheel.

Update checking

Maintainers can check for upstream source or licensing changes with:

  python .github/scripts/check_image_build_inputs.py

The checker reports changed files, commits, digests, licenses, and notices. It never modifies pins automatically.

Scheduled notifications are documented as deferred work; upstream changes do not block unrelated pull requests.

Usage

  sbx image build

  sbx run the-quest \
    --image '~/.smolvm/images/sbx' \
    --run-user agent \
    --project-path . \
    --writable-mounts \
    --write-config

Compatibility

• Existing image manifests and legacy kernel filenames remain usable.
• image build-debian, --with-docker, --kernel-url, and the unused build-time --ssh-public-key are removed without aliases.
• Custom Containerfiles remain supported but conservatively advertise no Docker feature.

Validation

• 197 tests passed.
• Ruff passed.
• Wheel verified to exclude the upstream SmolVM/Moby files.
• All seven pinned downloads were verified against their live immutable URLs.
• git diff --check passed.
• Live Docker/QEMU smoke test was not run.