harden build scripts and fix correctness issues from audit

Security & correctness fixes following the audit in REPORT.md.

  - setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
    check failures properly, return valid exit codes, and fetch
    /releases/latest (arch-aware) instead of the possibly-draft .[0]
  - entrypoint.sh: quote "$@" and build --net conditionally so empty
    NET_INTERFACE/NET_MAC don't yield "tap=,mac="
  - image-updater: replace tight 3s retry loop with capped exponential
    backoff + periodic pull instead of hammering the registry
  - sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
  - vm.Dockerfile: copy only host private keys at mode 600 instead of
    the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
  - Makefile: stop generating redundant _pub key files
  - build-image.sh: detect failure via alpine-make-vm-image's real exit
    status rather than grepping stdout for "ERROR"
  - remove orphaned etc/alloy/config.alloy (service not installed)
  - README: correct data.raw path
  - add REPORT.md audit notes (H1/H2 accepted as out-of-scope)

image/build-image.sh

@@ -14,14 +14,18 @@ TMP=$(mktemp)
 modprobe nbd max_parts=8  && [ -e /dev/nbd0 ] || mknod /dev/nbd0 b 43 0
 
 cleanup() {
-	 rm $TMP
+	 rm -f "$TMP" "${TMP}.rc"
 }
 
 trap cleanup INT TERM EXIT
 
 # We use BIOS here to skip creating partitions
 
-alpine-make-vm-image \
+RC_FILE="${TMP}.rc"
+
+# Capture the real exit status of alpine-make-vm-image (the `| tee` pipeline
+# would otherwise mask it behind tee's status; busybox ash has no PIPESTATUS).
+{ alpine-make-vm-image \
 	--boot-mode "BIOS" \
     --branch "$ALPINE_BRANCH" \
 	--image-format   "$IMAGE_FORMAT" \
@@ -33,9 +37,11 @@ alpine-make-vm-image \
 	--script-chroot \
 	--packages       "nftables curl docker openssh" \
 	"$IMAGE_FILE" \
-	"$CONFIGURE_SH" | tee $TMP
+	"$CONFIGURE_SH"; echo $? > "$RC_FILE"; } 2>&1 | tee "$TMP"
 
-if grep -q "ERROR" $TMP; then
-    echo "BUILD FAILED"
-    exit 114514
+rc=$(cat "$RC_FILE" 2>/dev/null || echo 1)
+
+if [ "$rc" -ne 0 ]; then
+    echo "BUILD FAILED (alpine-make-vm-image exited $rc)"
+    exit 1
 fi