feat: add MOK-based secure boot signing

- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
  (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
  (already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
  boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
  public MOK in the image. Smoke test now asserts the enroll unit exists.

tests/smoke/verify-rootfs.sh

@@ -69,6 +69,8 @@ have_file "usr/local/sbin/arcline-rollback" \
   && ok "btrfs rollback tooling present" || bad "missing arcline-rollback"
 have_file "usr/lib/systemd/system/arcline-snapshot.timer" \
   && ok "snapshot timer unit present" || bad "missing arcline-snapshot.timer"
+have_file "usr/lib/systemd/system/arcline-mok-enroll.service" \
+  && ok "secure-boot MOK enrollment unit present" || bad "missing arcline-mok-enroll.service"
 
 grep -qi 'arcline' "$ROOTFS/etc/arcline-release" 2>/dev/null \
   && ok "arcline-release present" || bad "missing /etc/arcline-release"