* Optionally link rootfs into kernel based on target
* Fully carve out dedicated nitro target
  * Only build nitro with TARGET=nitro
* verify nitro demo actually boots in live enclaves
* have "sign" make target that creates/signs hash manifest of all targets
* compile against musl
* fix kernel cache misses that result in re-pull/rebuild on every build