Fix first-run setup timing out on the kernel download

On a Mac without the Linux kernel, setup ran `container system start
--enable-kernel-install` with a 120 s limit. That command downloads a
697 MB archive without printing anything, so most connections hit the
limit and the window showed `timedOut([...])`.

- Start the service with --disable-kernel-install (10 min: a first
  start still pulls the 69 MB base filesystem).
- Download the kernel in its own step with progress, then hand the file
  to `container system kernel set --tar ... --digest ...`, which checks
  it against the runtime's digest.
- Opening the setup window no longer starts the download; Set Up does.
- Timeouts and runner errors read as sentences.
- A rebuild deletes the image it replaced, which frees about 2 GB each
  time, and deletes or stops the builder VM unless it was already
  running (it kept about 2.8 GB of memory).
- Setup asks for 10 GB free, measured on a real setup.

Sources/Knotchy/AppDelegate.swift

@@ -158,6 +158,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         quitting = true
         setupFlow.cancel()
         if setupFlow.isDownloading { SystemRuntimeInstaller.removeLeftovers() }
+        if controller.state == .settingUp(.kernelMissing) { ContainerCLIBackend.removeKernelDownloads() }
         // Not Now mid-build closes the window before the build ends.
         if setupFlow.allRequiredDone { UserDefaults.standard.set(true, forKey: SetupLaunchRule.completedKey) }
         // Synchronous on purpose: terminate: often runs inside a non-reentrant main-queue block; awaiting here deadlocked.

Sources/Knotchy/MenuBar.swift

@@ -205,7 +205,8 @@ struct SessionSummary {
         switch issue {
         case .cliMissing: "Installing the container runtime…"
         case .cliOutdated: "Updating the container runtime…"
-        case .serviceStopped, .kernelMissing: "Starting the container runtime…"
+        case .serviceStopped: "Starting the container runtime…"
+        case .kernelMissing: "Downloading the Linux kernel…"
         default: "Building the VM…"
         }
     }

Sources/Knotchy/NotchViews.swift

@@ -553,7 +553,8 @@ private enum Setup {
     static func symbol(_ issue: SetupIssue) -> String {
         switch issue {
         case .cliMissing, .cliOutdated: "shippingbox"
-        case .serviceStopped, .kernelMissing: "power"
+        case .serviceStopped: "power"
+        case .kernelMissing: "arrow.down.circle"
         case .imageMissing, .imageOutdated: "square.and.arrow.down"
         case .imageStale: "arrow.triangle.2.circlepath"
         case .lowDisk: "internaldrive"
@@ -564,7 +565,8 @@ private enum Setup {
         switch issue {
         case .cliMissing: "Knotchy needs Apple's container runtime"
         case .cliOutdated: "Knotchy needs a newer container runtime"
-        case .serviceStopped, .kernelMissing: "The container service isn't running"
+        case .serviceStopped: "The container service isn't running"
+        case .kernelMissing: "The container runtime needs its Linux kernel"
         case .imageMissing, .imageOutdated: "The browser VM image needs to be built"
         case .imageStale: "Updating the browser VM"
         case .lowDisk: "Not enough disk space"
@@ -575,7 +577,8 @@ private enum Setup {
         switch issue {
         case .cliMissing: "Installing the container runtime…"
         case .cliOutdated: "Updating the container runtime…"
-        case .serviceStopped, .kernelMissing: "Starting the container runtime…"
+        case .serviceStopped: "Starting the container runtime…"
+        case .kernelMissing: "Setting up the container runtime…"
         default: title(issue)
         }
     }
@@ -584,7 +587,8 @@ private enum Setup {
         switch issue {
         case .cliMissing: "Set it up in one step; the link opens when it's done."
         case .cliOutdated: "Update it in one step; the link opens when it's done."
-        case .serviceStopped, .kernelMissing: "Start it to run the isolated browser."
+        case .serviceStopped: "Start it to run the isolated browser."
+        case .kernelMissing: "It's a 700 MB download. The link opens when it's done."
         case .imageMissing, .imageOutdated: "This takes about 3 minutes and downloads about 225 MB."
         case .imageStale: "Rebuilding gets the latest WebKit security fixes."
         case .lowDisk(let free): "Only \(free / 1_000_000_000) GB free; a session needs about 2 GB."
@@ -594,7 +598,8 @@ private enum Setup {
     static func action(_ issue: SetupIssue) -> String? {
         switch issue {
         case .cliMissing, .cliOutdated: "Set Up…"
-        case .serviceStopped, .kernelMissing: "Start Service"
+        case .serviceStopped: "Start Service"
+        case .kernelMissing: "Download"
         case .imageMissing, .imageOutdated: "Build Image"
         case .imageStale: "Update Now"
         case .lowDisk: nil