Fix release tarball naming: version from git tag in CI, not hardcoded

Split main.zig into focussed modules

 Add systemd rescue.target support, build caching, and CLI improvements

systemd integration:
- Add --systemd-mode flag (skips init coordination and process kill)
- NixOS module (services.xenomorph) with rescue.target pivot service
  and boot-time cache warmup service

Build caching:
- Cache built rootfs as OCI layouts in $CACHE_DIRECTORY or --cache-dir
- Repeated pivot/build with same layers skips all image pulls
- xenomorph build with no -o flag is cache-only (pre-warm mode)
- CACHE_DIRECTORY env var support (set by systemd CacheDirectory=)

CLI changes:
- Rename --exec to --entrypoint, add --command/--cmd
- --tailscale-authkey adds tailscale image and creates init script
- Add --log-dir for configurable headless log location
- De-duplicate --image/--rootfs args with normalized image refs
- Add RAM check before pivot (error <10% free, warn <25%)
- build output is optional (null = cache only)

Other:
- Fix aarch64 fork (use clone syscall, no fork on arm64)
- Update oci-zig dependency
- Update README with full usage docs and rescue.target examples
- NixOS VM test for rescue.target flow
- Remove old QEMU integration test

Build static binaries for x86_64, aarch64, and armv7

- All builds now use musl for fully static binaries
- Cross-compile all architectures from x86_64 using Zig
- Remove dynamic glibc-linked build
- Release includes tarballs for all three architectures

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>