Template build flow

A build resolves the source, boots a synthesised one-VM lab, runs the provisions, then flattens and seals into the store; a failed build leaves nothing behind.

vmlab template build resolves the source (URL downloads are cached and content-addressed under ~/.cache/vmlab/artefacts/), creates a working qcow2, synthesises a one-VM lab from the template definition, boots it per the hardware profile, runs the provision scripts (full wscript API — keystrokes, screen matching, exec; the script should install the QEMU guest agent), shuts down gracefully, flattens and seals into the store. A failed build leaves nothing behind. The sealed result is ~/.local/share/vmlab/templates/<arch>/<name>/<version>/ (disk.qcow2 + template.wcl). The step-by-step runbook is Build a disk template.