feat: add disk-deploy core, disk image builder, and installer

- deploy-disk.sh: the shared "write a finished system to a disk" step —
  partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
  rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
  ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
  UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
  loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
  learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
  qemu-utils, dpkg, sbsigntool to the build image.

editions/cloud/metadata.yaml

@@ -9,10 +9,11 @@ description: >
   network stack. Same hardening baseline as server.
 
 image:
-  type: iso
-  boot: bios+efi
+  type: disk            # cloud edition ships as a bootable qcow2/raw disk image
+  boot: bios             # primary boot mode (UEFI via --boot efi)
   filesystem: btrfs
   compression: zstd:3
+  default_size: 4G
 
 packages:
   extra_repos: []