feat: add MOK-based secure boot signing

- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
  (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
  (already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
  boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
  public MOK in the image. Smoke test now asserts the enroll unit exists.

scripts/secureboot/gen-keys.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — secure boot: MOK key generation
+#
+#   scripts/secureboot/gen-keys.sh [--keydir build/keys]
+#
+# Generates a Machine Owner Key (MOK) signing keypair for self-signing the
+# kernel and EFI boot chain. MOK is the pragmatic secure-boot path for a
+# self-hosted distro: you enroll the key once (one-time prompt at first boot)
+# and then every Arcline update is verified against it. No third-party CA.
+#
+# Outputs (default build/keys/):
+#   MOK.priv   — private signing key (keep this secret, back it up)
+#   MOK.pem    — certificate in PEM form (for sbsign)
+#   MOK.der    — certificate in DER form (for mokutil enrollment)
+#
+# Requires openssl. Enrollment on a target system is handled by
+# arcline-mok-enroll.service (see overlays/base).
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/../../scripts/common.sh"
+
+KEYDIR="${1:-$BUILD_DIR/keys}"
+[[ "${1:-}" == "--keydir" ]] && KEYDIR="${2:?usage: gen-keys.sh [--keydir <dir>]}"
+
+command -v openssl >/dev/null || die "openssl not found"
+
+if [[ -f "$KEYDIR/MOK.priv" && -f "$KEYDIR/MOK.pem" && -f "$KEYDIR/MOK.der" ]]; then
+  log "MOK keypair already exists in $KEYDIR — keeping it (delete to regenerate)"
+  exit 0
+fi
+
+mkdir -p "$KEYDIR"
+log "generating MOK signing keypair in $KEYDIR"
+openssl req -new -x509 -newkey rsa:3072 -sha256 -nodes \
+  -keyout "$KEYDIR/MOK.priv" \
+  -outform DER -out "$KEYDIR/MOK.der" \
+  -subj "/CN=Arcline OS MOK/OU=Secure Boot/O=Arcline IT LLC" \
+  -days 3650
+openssl x509 -in "$KEYDIR/MOK.der" -inform DER -out "$KEYDIR/MOK.pem" -outform PEM
+
+chmod 600 "$KEYDIR/MOK.priv"
+log "generated: MOK.priv (keep secret), MOK.pem, MOK.der"
+log "to enroll on a running system:"
+log "  sudo mokutil --import $KEYDIR/MOK.der"