feat: add disk-deploy core, disk image builder, and installer

- deploy-disk.sh: the shared "write a finished system to a disk" step —
  partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
  rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
  ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
  UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
  loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
  learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
  qemu-utils, dpkg, sbsigntool to the build image.

scripts/apply-fstab.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — write a real /etc/fstab from an edition template
+#
+#   scripts/apply-fstab.sh <target-root> <edition> <root-uuid> [efi-uuid]
+#
+# Renders editions/<edition>/fstab with the real root partition UUID, drops
+# the template's swapfile line (no swap is created during deploy), and — in
+# EFI installs — appends the EFI system partition mount.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+TARGET="${1:?usage: apply-fstab.sh <target-root> <edition> <root-uuid> [efi-uuid]}"
+EDITION="${2:?usage: apply-fstab.sh <target-root> <edition> <root-uuid> [efi-uuid]}"
+ROOT_UUID="${3:?usage: apply-fstab.sh <target-root> <edition> <root-uuid> [efi-uuid]}"
+EFI_UUID="${4:-}"
+
+validate_edition "$EDITION"
+[[ -d "$TARGET" ]] || die "target '$TARGET' does not exist"
+
+EDIR="$(edition_dir "$EDITION")"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp" "$tmp.clean"' EXIT
+
+# template → real fstab; remove the swapfile line + its comment (no swap created on deploy)
+sed "s/__ROOT_UUID__/$ROOT_UUID/g" "$EDIR/fstab" | grep -v -E '(swapfile|^[[:space:]]*#.*swap)' > "$tmp.clean"
+
+if [[ -n "$EFI_UUID" ]]; then
+  printf 'UUID=%s  /boot/efi  vfat  umask=0077  0  1\n' "$EFI_UUID" >> "$tmp.clean"
+fi
+
+install -Dm0644 "$tmp.clean" "$TARGET/etc/fstab"
+log "wrote $TARGET/etc/fstab (root UUID $ROOT_UUID${EFI_UUID:+, efi UUID $EFI_UUID})"