fix: add --skip-dnsmasq/--skip-artifacts flags, fix config propagation

Enables running the TS bastion without dnsmasq for testing.
VM-tested: SSH works, partitions correct, k3s prereqs configured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/cli/commands/serve.ts

@@ -16,6 +16,8 @@ export function registerServeCommand(program: Command): void {
     .option("--arch <arch>", "Architecture", "x86_64")
     .option("--timezone <tz>", "Timezone", "Europe/London")
     .option("--locale <locale>", "Locale", "en_GB.UTF-8")
+    .option("--skip-dnsmasq", "Skip starting dnsmasq (for testing)")
+    .option("--skip-artifacts", "Skip downloading boot artifacts (for testing)")
     .action(async (opts: {
       port: string;
       dir: string;
@@ -25,6 +27,8 @@ export function registerServeCommand(program: Command): void {
       arch: string;
       timezone: string;
       locale: string;
+      skipDnsmasq?: boolean;
+      skipArtifacts?: boolean;
     }) => {
       await startBastion({
         httpPort: parseInt(opts.port, 10),
@@ -35,6 +39,8 @@ export function registerServeCommand(program: Command): void {
         arch: opts.arch,
         timezone: opts.timezone,
         locale: opts.locale,
+        skipDnsmasq: opts.skipDnsmasq,
+        skipArtifacts: opts.skipArtifacts,
       });
     });
 }