Enhance UVM installation and configuration for Ubuntu 22.04 root filesystem

- Update README and USAGE documentation to reflect changes in rootfs handling, including the default local build from Ubuntu 22.04 packages.
- Modify the installer to support building the rootfs locally with authenticated packages and to require SHA-256 checksums for prebuilt images.
- Implement checks for setuid permissions on sudo and update the provisioning logic for guest users to ensure proper sudo access.
- Adjust tests to validate the new rootfs building process and ensure that existing functionality is preserved.
- Refactor code to improve clarity and maintainability, including the introduction of constants for Ubuntu release and guest packages.

uvm/cli.py

@@ -74,8 +74,9 @@ def build_parser(application: Application) -> argparse.ArgumentParser:
     install = subcommands.add_parser(
         "install",
         description=(
-            "Set UVM_FIRECRACKER_SHA256, UVM_KERNEL_SHA256, and UVM_ROOTFS_SHA256 "
-            "to trusted digests. UVM_ALLOW_UNVERIFIED_DOWNLOADS=1 is an explicit "
+            "Set UVM_FIRECRACKER_SHA256 and UVM_KERNEL_SHA256 to trusted digests. "
+            "The default Ubuntu rootfs is built from signed packages. A custom "
+            "UVM_ROOTFS_URL also requires UVM_ROOTFS_SHA256. UVM_ALLOW_UNVERIFIED_DOWNLOADS=1 is an explicit "
             "development-only opt-out."
         ),
         help="install dependencies and assets; SHA-256 values are required by default",
@@ -83,7 +84,7 @@ def build_parser(application: Application) -> argparse.ArgumentParser:
     install.add_argument(
         "--force",
         action="store_true",
-        help="redownload Firecracker, kernel, and rootfs even when local assets already exist",
+        help="refresh downloads and rebuild the default Ubuntu rootfs even when assets exist",
     )
 
     create = subcommands.add_parser("create", help="create and boot a microVM detached")
@@ -111,7 +112,7 @@ def build_parser(application: Application) -> argparse.ArgumentParser:
     create.add_argument(
         "--username",
         default=application.settings.default_ssh_user,
-        help="guest login account; created if missing (defaults to root)",
+        help="guest administrator account; created if missing, with sudo access (defaults to root)",
     )
     credentials = create.add_mutually_exclusive_group()
     credentials.add_argument(