feat(digitalocean): Packer nightly snapshot pipeline for fast boot (#2198)

* feat(digitalocean): Packer nightly snapshot pipeline for fast boot

Add pre-built Packer snapshots for DigitalOcean droplets. Instead of
10-20 min cloud-init + agent install on every boot, snapshot-based
droplets boot in ~2-3 min (SSH only, agent pre-installed).

- Packer HCL2 template with parametrized agent/tier builds
- Agent build matrix (packer/agents.json) for all 7 agents
- Tier scripts mirroring cloud-init.ts package tiers
- Nightly GitHub Actions workflow (4 AM UTC, max-parallel: 3)
- Automatic cleanup: keeps only latest snapshot per agent
- CLI: findSpawnSnapshot() looks up pre-built images via DO API
- CLI: waitForSshOnly() skips cloud-init when using snapshots
- CLI: createServer() accepts optional snapshotId, skips user_data
- CLI: main.ts routes to fast path when snapshot detected
- Tests for findSpawnSnapshot() (5 cases, all passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(packer): use var-file for install_commands to avoid shell quoting issues

The previous approach passed install_commands as `-var` inline, but
GitHub Actions expands `${{ }}` before shell evaluation — JSON arrays
with `|`, `&&`, and `"` characters break shell quoting.

Fix: generate a `.auto.pkrvars.json` file (auto-loaded by Packer)
using jq with --argjson for safe JSON handling. Also route all
`${{ inputs }}` and `${{ matrix }}` values through env vars to
prevent script injection.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

packer/scripts/tier-bun.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -eo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get install -y --no-install-recommends \
+  curl \
+  unzip \
+  git \
+  ca-certificates \
+  zsh
+
+# Bun
+if ! command -v bun >/dev/null 2>&1; then
+  curl --proto '=https' -fsSL https://bun.sh/install | bash
+fi
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun 2>/dev/null || true
+
+# PATH setup
+for rc in /root/.bashrc /root/.zshrc; do
+  grep -q '.bun/bin' "$rc" 2>/dev/null || printf 'export PATH="$HOME/.local/bin:$HOME/.bun/bin:$PATH"\n' >> "$rc"
+done

packer/scripts/tier-full.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -eo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get install -y --no-install-recommends \
+  curl \
+  unzip \
+  git \
+  ca-certificates \
+  zsh \
+  build-essential
+
+# Node.js 22 via n
+curl --proto '=https' -fsSL https://raw.githubusercontent.com/tj/n/master/bin/n | bash -s install 22
+
+# Bun
+if ! command -v bun >/dev/null 2>&1; then
+  curl --proto '=https' -fsSL https://bun.sh/install | bash
+fi
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun 2>/dev/null || true
+
+# PATH setup
+for rc in /root/.bashrc /root/.zshrc; do
+  grep -q '.bun/bin' "$rc" 2>/dev/null || printf 'export PATH="$HOME/.local/bin:$HOME/.bun/bin:$PATH"\n' >> "$rc"
+done

packer/scripts/tier-minimal.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get install -y --no-install-recommends \
+  curl \
+  unzip \
+  git \
+  ca-certificates

packer/scripts/tier-node.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -eo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get install -y --no-install-recommends \
+  curl \
+  unzip \
+  git \
+  ca-certificates \
+  zsh \
+  build-essential
+
+# Node.js 22 via n
+curl --proto '=https' -fsSL https://raw.githubusercontent.com/tj/n/master/bin/n | bash -s install 22
+
+# PATH setup
+for rc in /root/.bashrc /root/.zshrc; do
+  grep -q '.bun/bin' "$rc" 2>/dev/null || printf 'export PATH="$HOME/.local/bin:$HOME/.bun/bin:$PATH"\n' >> "$rc"
+done