Add Containerfile: build boco (musl) + slim kernel; runnable runner image

- 3-stage build: musl boco+boco-init (rust>=1.88, alpine:edge), linux-7.2
  bzImage from kernel/config (pinned tarball, sha256-verified), slim runtime
  with qemu/virtiofsd/podman.
- .containerignore: deny-all context (Cargo files, src/, init/, kernel/config)
  so the linux submodule no longer ships into every build.
- Verified end-to-end: kernel boots under KVM, ext4 rootfs, userspace init.
- NOTE: nested rootless podman cannot 'podman unshare -> container mount'
  (build path); boot path works as-is.

Containerfile

@@ -23,11 +23,11 @@ RUN cargo build --release -p boco -p boco-init \
 FROM alpine:3.22 AS kernel
 # g++ for host tools, libelf for objtool, openssl for extract-cert
 RUN apk add --no-cache make gcc g++ musl-dev perl flex bison bc \
-      elfutils-dev openssl-dev findutils tar xz zstd curl linux-headers diffutils
+      elfutils-dev openssl-dev findutils tar xz zstd curl linux-headers
 WORKDIR /kbuild
 # Pinned upstream tarball: linux-7.2.tar.xz, sha256
 # f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3.
-# (Equivalent to the upstream shallow pin 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
+# (Equivalent to user's shallow pin 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
 # = refs/tags/v7.2{} — verified via `git ls-remote`; the tarball avoids
 # a multi-GB shallow clone through flaky slirp NAT.)
 RUN curl -fsSLo /tmp/linux-7.2.tar.xz https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz \
@@ -60,6 +60,7 @@ COPY --from=build /src/target/release/boco-init /home/boco/.local/share/boco/boc
 COPY --from=kernel /vmlinuz /home/boco/.local/share/boco/vmlinuz
 RUN chmod 755 /usr/local/bin/boco /home/boco/.local/share/boco/boco-init /home/boco/.local/share/boco/vmlinuz
 ENV XDG_DATA_HOME=/home/boco/.local/share
+ENV XDG_DATA_HOME=/home/boco/.local/share
 WORKDIR /data
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD ["image", "list"]