feat: add disk-deploy core, disk image builder, and installer

- deploy-disk.sh: the shared "write a finished system to a disk" step —
  partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
  rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
  ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
  UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
  loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
  learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
  qemu-utils, dpkg, sbsigntool to the build image.

scripts/check-host-deps.sh

@@ -18,6 +18,19 @@ NEEDED=(
   "xorriso|xorriso"
   "cpio|cpio"
   "bash|bash"
+  # disk images / installer
+  "sgdisk|gdisk"
+  "partprobe|parted"
+  "rsync|rsync"
+  "mkfs.vfat|dosfstools"
+  "qemu-img|qemu-utils"
+  "losetup|util-linux"
+  # vendor packaging + secure boot
+  "unzip|unzip"
+  "dpkg-deb|dpkg"
+  "openssl|openssl"
+  "sbsign|sbsigntool"
+  "sbverify|sbsigntool"
 )
 
 MISSING=()