feat(backend): remove smolmachines; firecracker is the Linux default

Delete the smolmachines backend (the whole bot_bottle/backend/smolmachines
package and its tests). It had fatal Linux issues (TSI networking under
sustained use, exec-channel contention, no SIGWINCH) and is superseded by
the Firecracker backend (issue #342).

Backend selection now:
- default is macos-container on macOS, firecracker on KVM-capable Linux
  hosts, and docker as the last resort (was smolmachines).
- firecracker is selected on a KVM host even when the `firecracker`
  binary isn't installed, so start routes through its preflight and
  prints an install pointer (same UX as require_container), instead of
  silently falling back. Split is_host_capable() (Linux + KVM) out of
  is_available() (adds the binary check) to drive this.

Retarget the cross-backend tests (parity, print-parity, prepare,
workspace, freezer, selection) from smolmachines to firecracker rather
than dropping the coverage. Remove docker.util.image_id/save, which only
smolmachines used. Update README/AGENTS/example bottles and stale
comments; historical docs/prds are left as a point-in-time record.

BREAKING: BOT_BOTTLE_BACKEND=smolmachines now errors as unknown.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_backend_prepare.py

@@ -17,7 +17,7 @@ from bot_bottle import supervise
 from bot_bottle.backend import BottleSpec
 from bot_bottle.backend.docker import DockerBottleBackend
 from bot_bottle.backend.resolve_common import mint_slug
-from bot_bottle.backend.smolmachines import SmolmachinesBottleBackend
+from bot_bottle.backend.firecracker import FirecrackerBottleBackend
 from bot_bottle.manifest import ManifestIndex
 
 
@@ -90,30 +90,28 @@ class TestDockerPrepare(_FakeStateMixin, unittest.TestCase):
         self.assertNotIn("FORWARDED_ENV", plan.agent_provision.guest_env)
 
 
-class TestSmolmachinesPrepare(_FakeStateMixin, unittest.TestCase):
+class TestFirecrackerPrepare(_FakeStateMixin, unittest.TestCase):
     def test_records_backend_and_builds_guest_env(self) -> None:
-        backend = SmolmachinesBottleBackend()
-        spec = _spec(Path(self.tmp.name), identity="demo-smol")
+        backend = FirecrackerBottleBackend()
+        spec = _spec(Path(self.tmp.name), identity="demo-fc")
 
         with (
             patch.dict("os.environ", {"HOST_SECRET_ENV": "secret-value"}),
             patch(
-                "bot_bottle.backend.smolmachines.resolve_plan.smolmachines_preflight",
+                "bot_bottle.backend.firecracker.resolve_plan.util.require_firecracker",
             ) as preflight,
         ):
             plan = backend.prepare(spec, Path(self.tmp.name) / "stage")
 
         preflight.assert_called_once_with()
-        metadata = bottle_state.read_metadata("demo-smol")
+        metadata = bottle_state.read_metadata("demo-fc")
         self.assertIsNotNone(metadata)
         assert metadata is not None
-        self.assertEqual("smolmachines", metadata.backend)
-        self.assertEqual("literal-value", plan.guest_env["LITERAL_ENV"])
-        self.assertEqual("secret-value", plan.guest_env["FORWARDED_ENV"])
+        self.assertEqual("firecracker", metadata.backend)
         self.assertEqual(
-            "/etc/ssl/certs/ca-certificates.crt",
-            plan.guest_env["SSL_CERT_FILE"],
+            "literal-value", plan.agent_provision.guest_env["LITERAL_ENV"],
         )
+        self.assertEqual({"FORWARDED_ENV": "secret-value"}, plan.forwarded_env)
 
 
 class TestMintSlug(unittest.TestCase):