feat(images): build and qualify the Ubuntu X11 desktop VM

[jmgilman]

Change

• Add Ubuntu 24.04 amd64 split VM recipe: GDM Xorg autologin, automation user, persistent Cua Driver session daemon, and human-only TCP VNC.
• Extend protected image publication, boot qualification, and generated catalog promotion to ubuntu/24.04/desktop.
• Record native token continuity, binary PNG retrieval, restart recovery, timings, and image sizes.

Pin exception

Cua Driver 0.28.1 is marked prerelease on GitHub; the earlier user-approved exception is explicit in pins/report. The full asset is SHA-256 pinned; no curl-pipe installer.

Verification

• Corrected image built and boot-tested on the cluster: X11, active Driver user unit, native list_apps returned 234 entries. Smoke cleaned only its own resources.
• Corrected qcow2: 745,013,248 bytes, 16 GiB virtual; assembly 392.512 seconds; peak scratch 7,621,808,128 bytes.
• uv run --locked --script images/build.py validate passed.
• Full real MCP acceptance passed in 158.45 seconds; representative program took 23.624 seconds. A native foreground token click changed the editor from one tab to two, confirmed by a fresh accessibility tree and fetched PNG.
• Reboot recovered Driver and the advertised VNC forward; screenshot URL returned 404 at 27.120 seconds after sandbox expiry.
• OVN ENOSPC recovery and active log controls are verified; source prevention is GilmanLab/fleet#20.

Merge ordering

Do not merge until the runner-publisher produced by approved bootstrap #23 / private bake 34854323245 is deployed to the controller. That protected bake succeeded. This PR then triggers the four-image bake; its generated catalog PR will contain the real immutable desktop digest. No digest is fabricated here.

The server implementation is a separate PR. The acceptance above exercised the combined implementation against the corrected local image, not a published desktop digest.