Turnstone container-VM: podman image -> boco qcow2 boot

Arch image with turnstone (venv), dev toolkit, rootless podman; boots
via boco (virtiofs shares, direct UID mapping for nested virtiofs).
sshd ops channel + turnstone-server as guest marvin; state (SQLite db,
config, work) on host shares; LLM via the TensorX OpenAI-compatible
gateway (https://api.tensorx.ai/v1), reachable from the guest through
both slirp layers with no relay.

scripts/build.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Build the turnstone VM image: podman image -> boco qcow2.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# Dedicated ssh keypair for the VM ops channel (created once)
+if [ ! -f configs/ssh/id_ed25519 ]; then
+  ssh-keygen -t ed25519 -N "" -C "marvin-turnstone-vm" -f configs/ssh/id_ed25519
+fi
+ssh-keygen -y -f configs/ssh/id_ed25519 > configs/ssh/authorized_keys
+
+podman build \
+  --build-arg USER_ID="$(id -u)" \
+  --build-arg GROUP_ID="$(id -g)" \
+  -t marvin-turnstone .
+
+boco build qcow2 marvin-turnstone