feat: scaffold Arcline OS build system

Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.

- Makefile orchestrates everything (make iso-<edition>, check, test,
  toolchain, clean); versions.mk is the single source of truth for
  versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
  -> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
  archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
  are bundled into an image (auto by default; minimal builds available
  via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.

scripts/validate.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — fast, offline validation of the build tree.
+#
+#   scripts/validate.sh
+#
+# Runs on any machine (no root, no network). Checks:
+#   * every shell script parses (bash -n)
+#   * every edition has a complete manifest (metadata, packages, cmdline, fstab)
+#   * package lists reference no obvious duplicate lines
+#   * the Makefile + versions.mk parse
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+fail=0
+note_fail() { warn "$1"; fail=1; }
+
+log "validating shell scripts…"
+while IFS= read -r -d '' s; do
+  if ! bash -n "$s"; then
+    note_fail "syntax error in $s"
+  fi
+done < <(find "$ROOT/scripts" "$ROOT/btrfs" "$ROOT/toolchain" "$ROOT/tests" \
+           -name '*.sh' -type f -print0 2>/dev/null)
+
+log "validating editions…"
+for e in "${EDITIONS[@]}"; do
+  ed="$(edition_dir "$e")"
+  for f in metadata.yaml packages.list kernel.cmdline fstab; do
+    [[ -f "$ed/$f" ]] || note_fail "edition '$e' missing $f"
+  done
+
+  # package list sanity: no blank-or-comment duplicates
+  if [[ -f "$ed/packages.list" ]]; then
+    dup="$(grep -vE '^\s*(#|$)' "$ed/packages.list" | sort | uniq -d)"
+    [[ -z "$dup" ]] || note_fail "edition '$e' has duplicate package entries: $(echo "$dup" | tr '\n' ' ')"
+  fi
+done
+
+log "validating top-level Makefile / versions.mk…"
+make -C "$ROOT" -n check >/dev/null 2>&1 || note_fail "Makefile dry-run failed (make -n check)"
+
+log "validating YAML manifests (if python3 + pyyaml available)…"
+if python3 -c 'import yaml' 2>/dev/null; then
+  python3 - "$ROOT" <<'PYEOF' || note_fail "YAML manifest parse failed"
+import sys, glob, yaml
+root = sys.argv[1]
+for f in sorted(glob.glob(root + "/editions/*/metadata.yaml")):
+    d = yaml.safe_load(open(f))
+    assert d.get("edition") and d.get("codename"), f"{f}: missing edition/codename"
+    assert d.get("image", {}).get("type"), f"{f}: missing image.type"
+    assert "services" in d, f"{f}: missing services"
+    assert isinstance(d["services"].get("enabled", []), list)
+PYEOF
+else
+  warn "python3/pyyaml not available — skipping YAML parse (structural checks above still apply)"
+fi
+
+if [[ $fail -eq 0 ]]; then
+  log "validation passed ✓"
+else
+  die "validation found problems"
+fi