Move the appliance/AMI build logic into tailscale.com/gokrazy/build so Go callers (e.g. flash-appliance) can call it directly instead of driving build.go over --json. build.go is now a thin flag wrapper; flags and --json output are unchanged. Package-level state becomes a Builder with an exported Config, ctx-first steps, and a Build one-shot. Updates #1866 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>