harden build scripts and fix correctness issues from audit

Security & correctness fixes following the audit in REPORT.md.

  - setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
    check failures properly, return valid exit codes, and fetch
    /releases/latest (arch-aware) instead of the possibly-draft .[0]
  - entrypoint.sh: quote "$@" and build --net conditionally so empty
    NET_INTERFACE/NET_MAC don't yield "tap=,mac="
  - image-updater: replace tight 3s retry loop with capped exponential
    backoff + periodic pull instead of hammering the registry
  - sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
  - vm.Dockerfile: copy only host private keys at mode 600 instead of
    the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
  - Makefile: stop generating redundant _pub key files
  - build-image.sh: detect failure via alpine-make-vm-image's real exit
    status rather than grepping stdout for "ERROR"
  - remove orphaned etc/alloy/config.alloy (service not installed)
  - README: correct data.raw path
  - add REPORT.md audit notes (H1/H2 accepted as out-of-scope)

README.md

@@ -11,8 +11,8 @@ Edit corresponding files in [image/overlay](./image/overlay) to customize VM beh
 # vim .env
 # VM_OPTS="--no-cache" HY_OPTS="--no-cache" make
 # fallocate -l 128G ./data/data.raw
-# sgdisk -o -n 1:0:0 -t 1:8300 ./data.raw
-# losetup -Pf ./data.raw
+# sgdisk -o -n 1:0:0 -t 1:8300 ./data/data.raw
+# losetup -Pf ./data/data.raw
 # mkfs.ext4 /dev/loop0p1
 # losetup -d /dev/loop0