decouple (mostly) from linux backend

* image is now the full rootfs string; users must specify docker:///
* update for new run api; specify path, args, and working dir
* env is replaced with params, which is a simple map of key-value strings,
  which do not allow interpolation, so the order doesn't matter
* unify build config with config file; removes duplication
* resource API is still linux-specific; requires bash syntax for stdin
  redirection. this will be replaced later once the Run API can accept stdin.
deps
update build config