fix: resolve grub-pc / grub-efi-amd64 "held broken packages" conflict

The edition package lists installed BOTH grub-pc and grub-efi-amd64
(+ shim-signed). Those provide the same bootloader role and conflict in
apt, so every rootfs build failed with "unable to correct problems, you
have held broken packages".

A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable
(mirroring the existing --boot bios|efi deploy option):

- versions.mk / common.sh: BOOT := bios (bios -> grub-pc,
  efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the
  Makefile.
- build-rootfs.sh validates BOOT early and injects the matching boot
  packages into the apt install; the static package lists no longer
  contain any grub package.
- deploy-disk.sh / build-image.sh / install.sh default --boot from the
  same BOOT variable, so a rootfs and the artifact deployed from it can
  never disagree (BOOT=efi make image-cloud produces a UEFI image).
- mokutil is now installed explicitly in the efi flavour (it was not
  pulled in because we install with --no-install-recommends).
- docs updated (building.md knob + rationale, secureboot.md note).

scripts/build-rootfs.sh

@@ -29,6 +29,14 @@ case "$ARCLINE_TOOLCHAIN" in
   *) die "ARCLINE_TOOLCHAIN must be auto|skip|require (got '$ARCLINE_TOOLCHAIN')" ;;
 esac
 
+# Fail fast on a bad boot flavour. grub-pc and grub-efi-amd64 conflict, so we
+# install exactly the one matching BOOT (never both).
+case "$BOOT" in
+  bios) BOOT_PKGS="grub-pc" ;;
+  efi)  BOOT_PKGS="grub-efi-amd64 shim-signed mokutil" ;;
+  *) die "BOOT must be bios|efi (got '$BOOT')" ;;
+esac
+
 EDIR="$(edition_dir "$EDITION")"
 ROOTFS="$ROOTFS_DIR/$EDITION"
 ARTIFACT="$ARTIFACT_DIR/arcline-$EDITION-$VERSION-$ARCH.tar.xz"
@@ -73,8 +81,8 @@ trap 'unmount_pseudo' EXIT
 chroot_run() { chroot "$ROOTFS" /bin/bash -c "$*"; }
 
 # ── 3. install edition packages ─────────────────────────────────────────────
-log "[3/6] installing edition packages (${EDITION})"
-PKGS="$(grep -vE '^\s*(#|$)' "$EDIR/packages.list" | tr '\n' ' ')"
+log "[3/6] installing edition packages (${EDITION}, boot: $BOOT)"
+PKGS="$(grep -vE '^\s*(#|$)' "$EDIR/packages.list" | tr '\n' ' ')$BOOT_PKGS"
 mount_pseudo
 chroot_run "export DEBIAN_FRONTEND=noninteractive; apt-get update -qq && apt-get install -y --no-install-recommends $PKGS" \
   | tee "$LOG_DIR/packages-$EDITION.log"