feat: Packer build orchestration (SAND-WP-0012)

Add vm-packer build mode, profile.vm-packer-build, State Hub progress
notes during long provision, docs/runbook, and build mode tests.

docs/runbooks/profile-vm-packer-build.md

@@ -0,0 +1,54 @@
+# profile.vm-packer-build — Runbook
+
+Trigger a Packer OVA build on the local workstation (build-machines lineage).
+
+## Prerequisites
+
+- **Packer** >= 1.10 (`packer version`)
+- **VirtualBox** >= 7.0 (`VBoxManage --version`)
+- Template directory from `the-custodian/infra/build-machines/haskell`
+- `sandboxer` on PATH
+
+## Build OVA
+
+```bash
+sandboxer create \
+  --profile profile.vm-packer-build \
+  --input packer_template=~/the-custodian/infra/build-machines/haskell \
+  --input vm_name=haskell-build \
+  --host localhost
+```
+
+Progress notes emit to State Hub during `packer init` and `packer build`.
+
+On success, `reachability.remote_dir` points at the produced `.ova` file.
+
+## Optional Packer variables
+
+Pass extra `-var` flags via inputs prefixed with `packer_var_`:
+
+```bash
+sandboxer create \
+  --profile profile.vm-packer-build \
+  --input packer_template=~/the-custodian/infra/build-machines/haskell \
+  --input vm_name=haskell-build \
+  --input packer_var_memory=16384 \
+  --host localhost
+```
+
+## Destroy
+
+```bash
+sandboxer destroy <sandbox_id>
+```
+
+Removes the sandbox record only; the OVA artifact on disk is preserved.
+
+## Attach workflow (post-build)
+
+After import/setup per build-machines README, use `profile.vm-haskell-build`
+for workspace attach — see `docs/runbooks/profile-vm-haskell-build.md`.
+
+## Migration reference
+
+`docs/migration-build-machines.md`