feat: scaffold Arcline OS build system

Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.

- Makefile orchestrates everything (make iso-<edition>, check, test,
  toolchain, clean); versions.mk is the single source of truth for
  versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
  -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
  archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
  are bundled into an image (auto by default; minimal builds available
  via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.

scripts/common.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — shared build environment + helpers
+#
+# Every script under scripts/ sources this first. Values mirror versions.mk;
+# when invoked through the Makefile the exported variables take precedence, so
+# versions.mk stays the single source of truth.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+# ── identity ────────────────────────────────────────────────────────────────
+: "${DISTRO_NAME:=Arcline OS}"
+: "${DISTRO_ID:=arclineos}"
+: "${VERSION:=0.1.0}"
+: "${RELEASE_NAME:=arclines}"
+: "${DEBIAN_SUITE:=bookworm}"
+: "${DEBIAN_MIRROR:=http://deb.debian.org/debian}"
+: "${SECURITY_MIRROR:=http://security.debian.org/debian-security}"
+: "${ARCH:=amd64}"
+: "${KERNEL_PACKAGE:=linux-image-amd64}"
+: "${KERNEL_VERSION:=6.1}"
+
+# Toolchain policy for image builds:
+#   auto    (default) install the Arcline tools if build/debs/*.deb exist,
+#           otherwise build without them (with a warning)
+#   skip    never install the tools, even if debs are present
+#   require fail the build if no toolchain debs are available
+: "${ARCLINE_TOOLCHAIN:=auto}"
+
+# ── paths (relative to the repo root) ───────────────────────────────────────
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+: "${BUILD_DIR:=$ROOT/build}"
+: "${ROOTFS_DIR:=$BUILD_DIR/rootfs}"
+: "${IMAGE_DIR:=$BUILD_DIR/iso}"
+: "${DEB_DIR:=$BUILD_DIR/debs}"
+: "${LOG_DIR:=$BUILD_DIR/logs}"
+: "${ARTIFACT_DIR:=$BUILD_DIR/artifacts}"
+
+# Valid edition names, mirroring versions.mk.
+EDITIONS=(server workstation cloud)
+
+# ── output helpers ──────────────────────────────────────────────────────────
+log()  { printf '\033[1;34m[arcline]\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33m[arcline]\033[0m warning: %s\n' "$*" >&2; }
+die()  { printf '\033[1;31m[arcline]\033[0m error: %s\n' "$*" >&2; exit 1; }
+
+# ── path helpers ────────────────────────────────────────────────────────────
+edition_dir() { printf '%s/editions/%s' "$ROOT" "$1"; }
+
+validate_edition() {
+  local e
+  for e in "${EDITIONS[@]}"; do [[ "$e" == "$1" ]] && return 0; done
+  die "unknown edition '$1' (expected: ${EDITIONS[*]})"
+}
+
+# ── privilege helper ────────────────────────────────────────────────────────
+# Builds need root (debootstrap / chroot / mount). If we are not root and sudo
+# is present, re-exec under sudo so the rest of the script can assume root.
+require_root() {
+  if [[ $EUID -eq 0 ]]; then
+    return 0
+  elif command -v sudo >/dev/null; then
+    exec sudo -E "$0" "$@"
+  else
+    die "build requires root: run with sudo or as root (debootstrap + chroot need it)"
+  fi
+}