feat: add server, workstation, and cloud edition manifests

Define the three flagship editions as plain-text manifests:

- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.

Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.

editions/server/metadata.yaml

@@ -0,0 +1,37 @@
+# Edition manifest: Arcline Server
+# Codename: bastion
+edition: server
+codename: bastion
+summary: Hardened, production-ready server OS with built-in observability and zero telemetry.
+description: >
+  Runs applications on bare metal or in the cloud. Ships with a default-deny
+  nftables firewall, AppArmor + seccomp, btrfs root with snapshot rollback,
+  Docker + Podman, and a pre-configured Prometheus / Grafana / Loki stack.
+
+image:
+  type: iso
+  boot: bios+efi
+  filesystem: btrfs
+  compression: zstd:3
+
+packages:
+  # Upstream repos added before package install (name -> [url, suite, component]).
+  extra_repos: []
+
+users:
+  # Accounts created at first boot by the installer/configure hook.
+  - arcline
+
+services:
+  # systemd units enabled by default.
+  enabled:
+    - systemd-networkd
+    - systemd-resolved
+    - ssh
+    - nftables
+    - apparmor
+    - prometheus-node-exporter
+    - arcline-snapshot.timer
+  masked:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer