Gate guest/boot SSH bring-up behind a nosshd build tag (opt-out)

[JAORMX]

Summary

Splits guest/boot so the SSH-specific code lives behind a
//go:build nosshd opt-out tag. The default build keeps SSH on
(current behavior, no consumer changes required); passing
-tags=nosshd swaps in a stub that drops golang.org/x/crypto/ssh
and guest/sshd from the link-time graph.

This is the link-time follow-up to #85 (WP-3.1 vsock + runtime
WithoutSSH). That PR gave callers a runtime knob to skip the SSH
listener; this one lets opt-out callers also strip the SSH code from
the binary at build time.

Why opt-out (not opt-in)

The first revision of this PR made SSH opt-in via -tags=sshd,
which would have required brood-box to update its build before being
able to bump go-microvm. Reviewer feedback (rightly) flagged that as
gratuitously disruptive — there's no reason to flip the default for
the existing consumer. Inverted to opt-out: brood-box needs no
changes, and bbox-k8s adds -tags=nosshd to its bbox-agent build
when it wants the link-time elimination.

What's in the PR (one commit)

• guest/boot/boot.go no longer imports golang.org/x/crypto/ssh or
  guest/sshd. The orchestrator now calls a single
  bringUpSSH(logger, cfg, envVars) provided by one of two new files.
• guest/boot/ssh_enabled.go (//go:build linux && !nosshd) — the
  real impl. Owns ParseAuthorizedKeys, host-key load, listener start.
  This is what the default build links.
• guest/boot/ssh_disabled.go (//go:build linux && nosshd) — stub.
  No-op when cfg.disableSSH is true; returns the new sentinel
  ErrSSHNotBuilt when it is false (loud-fail on misconfig).
• Tests split by the same tag:
  • boot_test.go — option/config tests (default + nosshd, no SSH types).
  • ssh_enabled_test.go (!nosshd) — ParseAuthorizedKeys + the
    generateTestKey helper that depends on x/crypto/ssh.
  • ssh_disabled_test.go (nosshd) — verifies both stub paths
    (no-op vs ErrSSHNotBuilt).
• Taskfile.yaml — test, test-nocgo, and build-nocgo now run
  both the default and -tags=nosshd variants so CI exercises both
  code paths.
• Host-side microvm.WithoutSSH doc and the guest/boot package doc
  both mention ErrSSHNotBuilt.

Verification

$ go list -deps ./guest/boot/                | grep -E "crypto/ssh|guest/sshd"
golang.org/x/crypto/ssh
golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
github.com/stacklok/go-microvm/guest/sshd

$ go list -tags=nosshd -deps ./guest/boot/   | grep -E "crypto/ssh|guest/sshd"
(empty)

A small boot.Run-importing test binary built two ways:

Build	Size	crypto/ssh + guest/sshd symbols (go tool nm)
default	7.5 M	518
-tags=nosshd	4.0 M	0

Consumer impact

• brood-box — no change required. The cmd/bbox-init build
  continues to work without any tag.
• bbox-k8s — no source change required (cmd/bbox-agent already
  calls boot.WithoutSSH()). After bumping to the release containing
  this change, add -tags=nosshd to the bbox-agent build to actually
  strip the SSH code from the binary. Without that tag, the binary
  works correctly (WithoutSSH still suppresses the listener at
  runtime) but still links the SSH code — same as today.

Test plan

• task fmt — clean
• task lint — 0 issues
• task test-nocgo — all packages pass under both default and
  -tags=nosshd
• go list -deps confirms crypto/ssh present by default,
  absent with -tags=nosshd
• Binary-level go tool nm: 0 SSH symbols with -tags=nosshd,
  518 in the default build
• CI: confirms both variants pass on the runners

🤖 Generated with Claude Code