feat: add MOK-based secure boot signing

- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
  (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
  (already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
  boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
  public MOK in the image. Smoke test now asserts the enroll unit exists.

scripts/build-iso.sh

@@ -45,6 +45,16 @@ INITRD="$(find "$ROOTFS/boot" -maxdepth 1 -name 'initrd.img-*' | sort -V | tail
 cp -L "$KERNEL" "$ISOFILES/live/vmlinuz"
 cp -L "$INITRD" "$ISOFILES/live/initrd.img"
 
+# ── 2b. secure boot (optional: ARCLINE_SIGN=1 + a MOK keypair) ──────────────
+if [[ "${ARCLINE_SIGN:-0}" == "1" ]]; then
+  log "secure boot: signing boot chain and shipping MOK in the live image"
+  [[ -f "$BUILD_DIR/keys/MOK.der" ]] || die "ARCLINE_SIGN=1 but no MOK keypair — run: scripts/secureboot/gen-keys.sh"
+  mkdir -p "$ROOTFS/etc/arcline"
+  cp "$BUILD_DIR/keys/MOK.der" "$ROOTFS/etc/arcline/MOK.der"
+  "$ROOT/scripts/secureboot/sign-image.sh" "$ROOTFS" --keydir "$BUILD_DIR/keys"
+  "$ROOT/scripts/secureboot/sign-image.sh" "$ISOFILES" --keydir "$BUILD_DIR/keys"
+fi
+
 log "compressing rootfs → squashfs (this takes a while)"
 # The squashfs is the live root. Keep it complete — offline man pages and
 # docs are a product promise (see the landing page), so nothing is excluded.