feat: Packer build orchestration (SAND-WP-0012)

Add vm-packer build mode, profile.vm-packer-build, State Hub progress
notes during long provision, docs/runbook, and build mode tests.

docs/migration-build-machines.md

@@ -8,7 +8,8 @@ Maps `the-custodian/infra/build-machines/` to sand-boxer `profile.vm-haskell-bui
 |-------------------------|---------------|
 | Packer OVA build | **Unchanged** — operator runs Packer in the-custodian |
 | VM boot + build-agent registration | **Unchanged** — systemd agent on VM |
-| `make remote-build PROJECT=` | `sandboxer create` + SSH into `reachability.remote_dir` |
+| `make remote-build PROJECT=` | `sandboxer create --profile profile.vm-haskell-build` + SSH build (shim in build-machines Makefile) |
+| `packer build` in `haskell/` | `sandboxer create --profile profile.vm-packer-build` |
 | Isolated workspace `/build/<project>` | `/build/sbx-<sandbox_id>/` per create |
 | `make bridge-status` | `ssh -p 12222 build@localhost` or `sandboxer inspect` (future) |
 
@@ -50,12 +51,36 @@ sandboxer destroy <sandbox_id>
 | `repo` | Optional rsync source to workspace |
 | `workspace_dir` | Override workspace path on VM |
 
+## Packer build mode (SAND-WP-0012)
+
+```bash
+sandboxer create \
+  --profile profile.vm-packer-build \
+  --input packer_template=~/the-custodian/infra/build-machines/haskell \
+  --input vm_name=haskell-build \
+  --host localhost
+```
+
+| Input | Purpose |
+|-------|---------|
+| `mode` | `build` (default for profile.vm-packer-build) or `attach` |
+| `packer_template` | Directory containing `*.pkr.hcl` |
+| `vm_name` / `vm` | Packer `vm_name` variable |
+| `packer_var_*` | Extra Packer `-var` flags (suffix → variable name) |
+
+Runbook: `docs/runbooks/profile-vm-packer-build.md`
+
+## Port registry (read-only pointer)
+
+`the-custodian/infra/build-machines/port-registry.yml` maps tunnel ports
+12221–12230 to VM slots. When attaching via tunnel, set
+`SANDBOXER_VM_TUNNEL_PORT` or `--input tunnel_port=` to a registered port.
+Full ops-bridge automation is deferred — operators bring tunnels up manually.
+
 ## Not migrated yet
 
-- Automated Packer `create` trigger from sand-boxer API
 - State Hub capability-catalog sync from build-agent (agent unchanged)
-- Port registry automation (`port-registry.yml`)
-- `make remote-build` Makefile targets in the-custodian (add shim in follow-on if needed)
+- Automated port-registry → ops-bridge config generation
 
 ## Runbook