fix(build): the root really is read-only, and two comments that overclaimed

Three places where build/ said something the tree does not do.

- fstab mounted `/` as `rw`. A box is started with `ro` on the kernel
  command line and `is_read_only: true` on the root device (every config in
  nesbox's tree agrees: examples/vm.json, test.json, run.local.json), so the
  virtio-blk device rejects writes whatever fstab asks for. `rw` here only
  made OpenRC's `root` service attempt a remount that has to fail. The
  Dockerfile already depended on the truth — it pre-creates /nestri/* at
  build time precisely because a runtime mkdir gets EROFS — so this makes
  fstab agree with the comment that was already right.

- build/README.md said nesbox's jail image "extracts Mesa and virglrenderer"
  from this base. It extracts only Mesa. virglrenderer is the host half of
  the native-context protocol and nesbox builds its own, patched, from
  nesbox/patches/; nothing in this image carries it at all.

- conf.d/nestri-user-env called the zink driver-forcing block "load-bearing"
  directly above three exports that are commented out, here and in the
  profile.d copy. Whether they should come back is a separate question; a
  comment insisting disabled lines are load-bearing tells the next reader
  the opposite of what the file does. The reasoning is kept, because it is
  still the reason to re-enable them, along with why both copies have to
  move together.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

build/etc/fstab

@@ -1,4 +1,10 @@
-/dev/vda    /          ext4     rw,relatime              0 1
+# `ro`, matching how a box is actually started: nesbox passes `ro` on the
+# kernel command line and marks the root device `is_read_only: true` (see
+# nesbox's examples/vm.json), so the virtio-blk device refuses writes at the
+# device level. Saying `rw` here does not make it writable — it only asks
+# OpenRC's `root` service to attempt a remount that the device must reject.
+# Everything a running box writes to is a tmpfs or a share below.
+/dev/vda    /          ext4     ro,relatime              0 1
 devtmpfs    /dev       devtmpfs rw,nosuid                0 0
 proc        /proc      proc     rw,nosuid,nodev,noexec   0 0
 sysfs       /sys       sysfs    rw,nosuid,nodev,noexec   0 0