fix: resolve grub-pc / grub-efi-amd64 "held broken packages" conflict

The edition package lists installed BOTH grub-pc and grub-efi-amd64
(+ shim-signed). Those provide the same bootloader role and conflict in
apt, so every rootfs build failed with "unable to correct problems, you
have held broken packages".

A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable
(mirroring the existing --boot bios|efi deploy option):

- versions.mk / common.sh: BOOT := bios (bios -> grub-pc,
  efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the
  Makefile.
- build-rootfs.sh validates BOOT early and injects the matching boot
  packages into the apt install; the static package lists no longer
  contain any grub package.
- deploy-disk.sh / build-image.sh / install.sh default --boot from the
  same BOOT variable, so a rootfs and the artifact deployed from it can
  never disagree (BOOT=efi make image-cloud produces a UEFI image).
- mokutil is now installed explicitly in the efi flavour (it was not
  pulled in because we install with --no-install-recommends).
- docs updated (building.md knob + rationale, secureboot.md note).

editions/cloud/packages.list

@@ -11,9 +11,10 @@ locales
 tzdata
 
 # ── boot ────────────────────────────────────────────────────────────────────
-grub-pc
-grub-efi-amd64
-shim-signed
+# The bootloader is chosen by the BOOT build variable and injected by
+# build-rootfs.sh: bios → grub-pc, efi → grub-efi-amd64 + shim-signed.
+# (Installing grub-pc and grub-efi-amd64 together makes apt fail with a
+# "held broken packages" conflict — exactly one is ever installed.)
 
 # ── kernel (cloud variant) ──────────────────────────────────────────────────
 linux-image-cloud-amd64

editions/server/packages.list

@@ -13,9 +13,10 @@ locales
 tzdata
 
 # ── boot ────────────────────────────────────────────────────────────────────
-grub-pc
-grub-efi-amd64
-shim-signed
+# The bootloader is chosen by the BOOT build variable and injected by
+# build-rootfs.sh: bios → grub-pc, efi → grub-efi-amd64 + shim-signed.
+# (Installing grub-pc and grub-efi-amd64 together makes apt fail with a
+# "held broken packages" conflict — exactly one is ever installed.)
 os-prober
 
 # ── kernel / firmware ───────────────────────────────────────────────────────

editions/workstation/packages.list

@@ -12,9 +12,10 @@ locales
 tzdata
 
 # ── boot ────────────────────────────────────────────────────────────────────
-grub-pc
-grub-efi-amd64
-shim-signed
+# The bootloader is chosen by the BOOT build variable and injected by
+# build-rootfs.sh: bios → grub-pc, efi → grub-efi-amd64 + shim-signed.
+# (Installing grub-pc and grub-efi-amd64 together makes apt fail with a
+# "held broken packages" conflict — exactly one is ever installed.)
 os-prober
 
 # ── kernel / firmware ───────────────────────────────────────────────────────