refactor: split main.rs into registry, build, and qemu modules

main.rs keeps only the CLI definition and command dispatch:
- registry.rs: image-name validation + XDG registry path handling (tests)
- build.rs: podman mount/unmount, vmlinuz extraction, cpio/gzip initrd
- qemu.rs: direct-kernel-boot VM launch

No behavior change; cargo fmt/clippy/test pass, build/run paths
verified against the mock-vm image.

src/build.rs

@@ -0,0 +1,115 @@
+//! Build: mount a podman image, extract vmlinuz, and pack the rootfs as a
+//! gzipped cpio initrd in the registry.
+
+use anyhow::{Context, Result, bail};
+use flate2::write::GzEncoder;
+use std::fs::{self, File};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+
+use crate::registry::registry_dir;
+
+pub(crate) fn build(image: &str) -> Result<()> {
+    let mount_path = mount_image(image)?;
+    println!("Mounted at: {}", mount_path.display());
+
+    // Keep the build result so the image is unmounted even when the build fails.
+    let result = build_artifacts(image, &mount_path);
+
+    let unmounted = Command::new("podman")
+        .args(["unshare", "--", "podman", "image", "unmount", image])
+        .output()
+        .is_ok_and(|out| out.status.success());
+    if unmounted {
+        println!("Unmounted image.");
+    } else {
+        eprintln!("warning: failed to unmount image '{}'", image);
+    }
+
+    result
+}
+
+fn mount_image(image: &str) -> Result<PathBuf> {
+    let output = Command::new("podman")
+        .args(["unshare", "--", "podman", "image", "mount", image])
+        .output()
+        .context("Failed to run podman image mount")?;
+    let mount_path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if !output.status.success() || mount_path.is_empty() {
+        bail!(
+            "podman image mount failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        );
+    }
+    Ok(PathBuf::from(mount_path))
+}
+
+fn build_artifacts(image: &str, mount_path: &Path) -> Result<()> {
+    let mount_path = mount_path.to_str().context("mount path is not UTF-8")?;
+    let vmlinuz_src = format!("{mount_path}/vmlinuz");
+
+    // The rootless overlay mount only exists inside podman unshare's user
+    // namespace, so every read of the rootfs must run there; pipes still
+    // cross the namespace boundary.
+    let has_kernel = Command::new("podman")
+        .args(["unshare", "--", "test", "-f", &vmlinuz_src])
+        .status()
+        .context("Failed to check for /vmlinuz inside the image mount")?;
+    if !has_kernel.success() {
+        bail!("Image missing required /vmlinuz. Place kernel at /vmlinuz in Containerfile.");
+    }
+
+    let reg_dir = registry_dir(image)?;
+    fs::create_dir_all(&reg_dir)?;
+    println!("Registry: {}", reg_dir.display());
+
+    let vmlinuz_dst = reg_dir.join("vmlinuz");
+    let cp_status = Command::new("podman")
+        .args([
+            "unshare",
+            "--",
+            "cp",
+            &vmlinuz_src,
+            vmlinuz_dst.to_str().context("registry path is not UTF-8")?,
+        ])
+        .status()
+        .context("Failed to copy vmlinuz out of the image mount")?;
+    if !cp_status.success() {
+        bail!("Failed to copy vmlinuz to registry");
+    }
+    println!("Copied vmlinuz -> {}", vmlinuz_dst.display());
+
+    // Pack the rootfs as a gzipped newc cpio archive; vmlinuz is excluded
+    // because QEMU loads the kernel separately via -kernel. The cpio
+    // pipeline runs inside the namespace, its stdout is compressed here.
+    let initrd_path = reg_dir.join("initrd");
+    let script = r#"cd "$1" && find . -not -path ./vmlinuz | cpio -o -H newc"#;
+    let mut cpio = Command::new("podman")
+        .args(["unshare", "--", "sh", "-c", script, "sh", mount_path])
+        .stdout(Stdio::piped())
+        .spawn()
+        .context("Failed to spawn the cpio pipeline")?;
+
+    let initrd_file = File::create(&initrd_path).context("Failed to create initrd file")?;
+    let mut encoder = GzEncoder::new(initrd_file, flate2::Compression::default());
+    let cpio_stdout = cpio.stdout.take().context("cpio stdout was not piped")?;
+    let copied = std::io::copy(&mut std::io::BufReader::new(cpio_stdout), &mut encoder);
+    let stream_result = copied
+        .and_then(move |_| encoder.finish().map(|_| ()))
+        .context("Failed to write the gzipped initrd");
+    let cpio_status = cpio
+        .wait()
+        .context("Failed to wait for the cpio pipeline")?;
+
+    if let Err(e) = stream_result {
+        let _ = fs::remove_file(&initrd_path);
+        return Err(e);
+    }
+    if !cpio_status.success() {
+        let _ = fs::remove_file(&initrd_path);
+        bail!("find/cpio pipeline failed with status {cpio_status}");
+    }
+    println!("Created initrd -> {}", initrd_path.display());
+
+    Ok(())
+}