Guard bbox-init embed behind bbox_full build tag

[JAORMX]

Summary

Fixes #110 — embedding the bbox-init guest binary unconditionally made brood-box uncompilable as a Go module dependency.

internal/infra/vm/initbin/embed.go used //go:embed bbox-init, but that binary is built by task build-init and is .gitignored. The module proxy serves the package without it, so any downstream consumer importing brood-box as a library hit a hard compile failure:

.../brood-box/internal/infra/vm/initbin/embed.go: pattern bbox-init: no matching files found

The dependency chain that pulls this in for library consumers:

pkg/runtime → pkg/sandbox → internal/infra/vm → internal/infra/vm/initbin (embed)

Approach (Option A from the issue — build-tag guard)

• embed_full.go (//go:build bbox_full) — the real //go:embed bbox-init directive.
• embed_stub.go (//go:build !bbox_full) — exports an empty Binary []byte.
• task build and task install now build the bbox CLI with -tags "embed_runtime bbox_full".
• Every other build — go test, golangci-lint, and library consumers — uses the stub and compiles cleanly without the bbox-init file present.

Fail-fast safety

InjectInitBinary now checks len(initbin.Binary) == 0 and returns an actionable error before writing, so a stub-built binary that tries to boot a VM fails clearly instead of writing a zero-byte init:

bbox-init binary not embedded: rebuild bbox with the 'bbox_full' build tag (e.g. `task build`)

The init-binary hook tests are split by build tag: content/permission assertions run under bbox_full; a new stub test asserts the guard error and that no file is written.

Verification

• ✅ go build ./internal/... ./pkg/... with the bbox-init file deleted (reproduces the original failure → now compiles).
• ✅ go build -tags bbox_full with the binary present.
• ✅ task build produces a working bin/bbox (embedded runtime + init).
• ✅ task test (stub) and go test -tags bbox_full ./internal/infra/vm/ both pass.
• ✅ task lint — 0 issues.

🤖 Generated with Claude Code