feat: add MOK-based secure boot signing

- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
  (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
  (already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
  boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
  public MOK in the image. Smoke test now asserts the enroll unit exists.

overlays/base/usr/lib/systemd/system/arcline-mok-enroll.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Enroll Arcline secure boot MOK (one-time)
+Documentation=docs/secureboot.md
+DefaultDependencies=no
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/arcline-mok-enroll.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sysinit.target

overlays/base/usr/local/sbin/arcline-mok-enroll.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Arcline OS — one-time MOK enrollment (runs at first boot, then disables itself)
+# No-op when no key was shipped in the image (secure boot off by default).
+set -euo pipefail
+
+KEY=/etc/arcline/MOK.der
+UNIT=arcline-mok-enroll.service
+
+if [[ ! -f "$KEY" ]]; then
+  echo "arcline: no MOK key shipped — secure boot enrollment skipped"
+  systemctl disable --now "$UNIT" 2>/dev/null || true
+  exit 0
+fi
+
+if mokutil --test-key "$KEY" 2>/dev/null | grep -q enabled; then
+  echo "arcline: MOK already enrolled"
+else
+  echo "arcline: importing MOK — you will be prompted to confirm it on the next reboot"
+  mokutil --import "$KEY" || true
+fi
+
+# enrollment is one-time; disable ourselves so this never runs again
+systemctl disable --now "$UNIT" 2>/dev/null || true