feat(railiance): implement CUST-WP-0032 Haskell build machine infra

Packer build definition, cloud-init autoinstall, GHCup toolchain script,
boot-time registration agent (state-hub + autossh dual tunnel), systemd
unit, key injection, remote-build Makefile, smoke test, and deployment
README. All 15 tasks complete.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/build-machines/haskell/files/build-agent.env.template

@@ -0,0 +1,21 @@
+# Custodian State Hub URL — always access via forward tunnel (port 18000).
+# The agent opens -L 18000:localhost:8000 alongside the reverse SSH tunnel,
+# so this works regardless of network topology (LAN, VPN, different subnet).
+# Matches the CoulombCore remote worker bridge pattern.
+STATE_HUB_URL=http://127.0.0.1:18000
+
+# Domain to register capability under
+STATE_HUB_DOMAIN=railiance
+
+# Workstation hostname or LAN IP for SSH relay connection
+# The VM connects OUT to this host to establish both tunnels.
+SSH_RELAY_HOST=192.168.1.100   # replace with actual workstation LAN IP
+SSH_RELAY_USER=worsch
+
+# Path to private key for SSH tunnel (matching authorized_keys on workstation)
+SSH_KEY_PATH=/home/build/.ssh/id_build
+
+# Port to bind on workstation (ssh -R <REMOTE_PORT>:localhost:22)
+# Each VM instance must use a distinct port — see port-registry.yml
+# Range: 12221-12230
+REMOTE_PORT=12222