feat: add grafana/loki/promtail vendor .debs

- toolchain/build-vendor.sh: packages the observability components that
  are not in Debian main — grafana (official OSS deb, vendored as-is),
  loki + promtail (static binaries from the Loki GitHub release, wrapped
  in minimal debs that install the overlays/server configs and systemd
  units from toolchain/vendor/). Version-pinned, overridable, and
  download failures skip with a warning (never break the OS build).
- configure-system.sh: auto-enables grafana-server/loki/promtail when
  their binaries land in the image.
- New `make vendor` target.

scripts/configure-system.sh

@@ -93,6 +93,20 @@ if [[ -d /arcline-debs ]] && ls /arcline-debs/*.deb >/dev/null 2>&1; then
     || warn "toolchain install incomplete (fix with: apt-get -f install)"
 fi
 
+# ── observability services (vendor debs from toolchain/build-vendor.sh) ─────
+# Only enabled when their binaries actually landed in the image.
+for svc_bin_unit in \
+  "/usr/sbin/grafana-server:grafana-server" \
+  "/usr/bin/loki:loki" \
+  "/usr/bin/promtail:promtail"; do
+  bin="${svc_bin_unit%%:*}"
+  unit="${svc_bin_unit##*:}"
+  if [[ -x "$bin" ]]; then
+    systemctl enable "$unit" 2>/dev/null || true
+    log "observability: enabled $unit ($bin present)"
+  fi
+done
+
 # ── optional upstream repos (grafana, loki) ─────────────────────────────────
 if [[ "$EXTRA_REPOS" == "1" ]]; then
   log "adding upstream observability repos (grafana, loki)"