vm-base-image-build-skilllisted

# VM Base Image Build / Refresh Flow Procedure to (re)build the agentic-sandbox QEMU base image (`/mnt/ops/base-images/ubuntu-server-<ver>-agent.qcow2`) so a provisioned VM boots with a working, self-enrolling agent over the vsock transport — no per-provision agent deploy required. This codifies the fix for #561 (the prior image was 5 months stale: no `agent-client`, a defunct `agentic-agent.service`, no vsock module). Anchors: ADR-023 (transport-per-runtime → VM uses vsock), ADR-026 (host-mediated enrollment), and `.aiwg/planning/vm-vsock-transport-implementation.md`. ## When to use - The qemu base image is stale or missing the current agent. - After an `agent-rs` change that must ship in the image by default. - When wiring/validating the vsock transport for VMs. - As a scheduled hygiene refresh (kernel/libs/tools currency). ## Preconditions - Host has `qemu-img virt-install genisoimage virt-customize` (libguestfs-tools). - An Ubuntu live-server ISO present under `ISO_DIR` (default `/mnt/ops/isos/linux`), pinned in `images/qemu/iso-pins.json` (integrity-verified at build). - The current agent binary is built: `agent-rs/target/release/agent-client` (the build bakes it in; absent ⇒ it warns and builds without the agent). ## Steps 1. **Build the current agent** (so it gets baked in): ```bash (cd agent-rs && cargo build --release) test -x agent-rs/target/release/agent-client ``` 2. **Run the base-image build** (10–20 min; full unattended install + customi