move workload image pulling and preparation to dedicated builder nodes

[t0gun]

Goal

Move workload image pulling, unpacking, and preparation off runtime hypervisor hosts and onto dedicated builder nodes.

Scope

• define a builder-plane architecture separate from runtime VM hosts
• move OCI image pulling, extraction, and workload image creation off bare-metal runtime nodes
• define how prepared workload images are published for runtime-node consumption
• reduce or remove runtime-host dependencies that only exist for image construction
• define the control-plane handoff between deployment/build completion and runtime launch
• prefer lz4 for prepared workload image compression in the builder-plane path so runtime-side decompression stays ultra-fast and lightweight

Why

• reduce CPU contention between image preparation and running customer microVMs
• reduce NVMe and filesystem contention on runtime hosts
• reduce security risk from unpacking untrusted customer image contents directly on hypervisor nodes
• avoid repeating identical image preparation work independently on multiple runtime nodes
• lz4 is designed explicitly for ultra-fast, lightweight decompression, so runtime hosts pay much less CPU cost when reading prepared workload images

Done When

• the dedicated builder-node direction is documented clearly enough to guide a later implementation
• the runtime-host responsibilities and builder-host responsibilities are separated explicitly
• the publication/consumption boundary for prepared workload images is defined
• the preferred builder-side compression direction is captured