feat: scaffold Arcline OS build system

Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.

- Makefile orchestrates everything (make iso-<edition>, check, test,
  toolchain, clean); versions.mk is the single source of truth for
  versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
  -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
  archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
  are bundled into an image (auto by default; minimal builds available
  via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.

scripts/apply-overlays.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — overlay application
+#
+#   scripts/apply-overlays.sh <rootfs> <edition>
+#
+# overlays/ is organised as layered filesystem trees:
+#     overlays/base/<abs path>            → every edition
+#     overlays/<edition>/<abs path>       → that edition only
+#
+# Files are copied preserving structure and permissions. Later layers win.
+# overlays/base is applied first, then the edition overlay.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+TARGET="${1:?usage: apply-overlays.sh <rootfs> <edition>}"
+EDITION="${2:?usage: apply-overlays.sh <rootfs> <edition>}"
+validate_edition "$EDITION"
+
+[[ -d "$TARGET" ]] || die "rootfs '$TARGET' does not exist"
+
+apply_layer() {
+  local layer="$1"
+  local src="$ROOT/overlays/$layer"
+  [[ -d "$src" ]] || { warn "overlay layer '$layer' not present, skipping"; return 0; }
+  log "applying overlay layer: $layer"
+  # Copy the *contents* of the layer dir into the rootfs, keeping dotfiles,
+  # symlinks, and permissions. Never clobber across layers silently — but
+  # cp -a with overwrite is the desired "later layer wins" behaviour here.
+  cp -a "$src/." "$TARGET/"
+}
+
+apply_layer base
+apply_layer "$EDITION"
+log "overlays applied ✓"