feat: add disk-deploy core, disk image builder, and installer

- deploy-disk.sh: the shared "write a finished system to a disk" step —
  partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
  rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
  ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
  UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
  loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
  learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
  qemu-utils, dpkg, sbsigntool to the build image.

scripts/install.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — scripted installer
+#
+#   scripts/install.sh <device> [--edition server] [--boot bios|efi]
+#       [--rootfs <dir> | --image <rootfs.tar.xz>]
+#
+# Installs an Arcline OS rootfs onto a real disk:
+#
+#   sudo scripts/install.sh /dev/sda --edition server
+#   sudo scripts/install.sh /dev/nvme0n1 --edition cloud --image build/artifacts/arcline-cloud-0.1.0-amd64.tar.xz
+#
+# WARNING: this WIPES <device>. You are asked to confirm the exact device path
+# before anything is written.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+DEV="${1:?usage: install.sh <device> [--edition server] [--boot bios|efi] [--rootfs <dir>|--image <tar.xz>]}"
+EDITION="server"
+BOOT="bios"
+ROOTFS_SRC=""
+
+shift || true
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --edition) EDITION="${2:?}"; shift 2 ;;
+    --boot)    BOOT="${2:?}";    shift 2 ;;
+    --rootfs)  ROOTFS_SRC="${2:?}"; shift 2 ;;
+    --image)   ROOTFS_SRC="${2:?}"; shift 2 ;;
+    *) die "unknown option '$1'" ;;
+  esac
+done
+
+require_root "$0" "$@"
+validate_edition "$EDITION"
+[[ "$BOOT" == "bios" || "$BOOT" == "efi" ]] || die "--boot must be bios|efi"
+[[ -b "$DEV" ]] || die "'$DEV' is not a block device — refusing to install"
+
+# ── resolve rootfs (dir or tarball) ─────────────────────────────────────────
+TMPROOT=""
+if [[ -n "$ROOTFS_SRC" ]]; then
+  if [[ -d "$ROOTFS_SRC" ]]; then
+    ROOTFS="$ROOTFS_SRC"
+  elif [[ -f "$ROOTFS_SRC" ]]; then
+    TMPROOT="$(mktemp -d /run/arcline-install.XXXXXX)"
+    log "extracting rootfs image: $ROOTFS_SRC"
+    tar -xJf "$ROOTFS_SRC" -C "$TMPROOT"
+    ROOTFS="$TMPROOT"
+  else
+    die "rootfs source '$ROOTFS_SRC' not found"
+  fi
+else
+  ROOTFS="$ROOTFS_DIR/$EDITION"
+  [[ -d "$ROOTFS" ]] || die "no rootfs for '$EDITION' at $ROOTFS (build it: make rootfs-$EDITION, or pass --rootfs/--image)"
+fi
+trap '[[ -n "$TMPROOT" ]] && { rm -rf "$TMPROOT"; }' EXIT
+
+# ── safety confirmation ─────────────────────────────────────────────────────
+echo
+echo "Arcline OS installer"
+echo "  target device : $DEV"
+echo "  edition       : $EDITION"
+echo "  boot          : $BOOT"
+echo
+echo "!!! ALL DATA ON $DEV WILL BE DESTROYED !!!"
+read -r -p "Type the device path to confirm ($DEV): " CONFIRM
+[[ "$CONFIRM" == "$DEV" ]] || die "confirmation mismatch — aborting"
+
+"$ROOT/scripts/deploy-disk.sh" "$DEV" "$ROOTFS" "$EDITION" --boot "$BOOT"
+
+echo
+log "install complete. Remove the installation media and reboot."
+log "After reboot: set a root password and enroll your ssh key"
+log "  sudo passwd root"