harden build scripts and fix correctness issues from audit

Security & correctness fixes following the audit in REPORT.md.

  - setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
    check failures properly, return valid exit codes, and fetch
    /releases/latest (arch-aware) instead of the possibly-draft .[0]
  - entrypoint.sh: quote "$@" and build --net conditionally so empty
    NET_INTERFACE/NET_MAC don't yield "tap=,mac="
  - image-updater: replace tight 3s retry loop with capped exponential
    backoff + periodic pull instead of hammering the registry
  - sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
  - vm.Dockerfile: copy only host private keys at mode 600 instead of
    the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
  - Makefile: stop generating redundant _pub key files
  - build-image.sh: detect failure via alpine-make-vm-image's real exit
    status rather than grepping stdout for "ERROR"
  - remove orphaned etc/alloy/config.alloy (service not installed)
  - README: correct data.raw path
  - add REPORT.md audit notes (H1/H2 accepted as out-of-scope)

scripts/entrypoint.sh

@@ -1,8 +1,18 @@
 #!/bin/sh
-set -euo pipefail
+set -eu
 
 API_SOCKET="/hy.socks"
 
+# Build the --net argument, omitting empty fields so cloud-hypervisor can pick
+# sensible defaults (auto-created tap / generated MAC) instead of getting
+# "tap=,mac=".
+NET_INTERFACE="${NET_INTERFACE:-}"
+NET_MAC="${NET_MAC:-}"
+NET_ARG="tap=${NET_INTERFACE}"
+if [ -n "$NET_MAC" ]; then
+  NET_ARG="${NET_ARG},mac=${NET_MAC}"
+fi
+
 /usr/bin/cloud-hypervisor \
   --kernel /boot/vmlinuz-virt --initramfs /boot/initramfs-virt \
   --disk path=/image/vm.raw,image_type=raw \
@@ -11,8 +21,8 @@ API_SOCKET="/hy.socks"
   --cmdline "root=/dev/vda rootfstype=ext4 modules=ext4a rw console=hvc0" \
   --cpus boot=${CPU_COUNT:-4} \
   --memory size=${MEMORY:-4G},shared=on \
-  --net "tap=$NET_INTERFACE,mac=$NET_MAC" \
-  $@ &
+  --net "$NET_ARG" \
+  "$@" &
 
 CH_PID=$!
 
@@ -24,4 +34,4 @@ _stop() {
 
 trap _stop TERM INT
 
-wait $CH_PID
+wait $CH_PID