feat: add server, workstation, and cloud edition manifests

Define the three flagship editions as plain-text manifests:

- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.

Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.

editions/workstation/packages.list

@@ -0,0 +1,101 @@
+# Arcline Workstation — package set
+# Curated KDE Plasma desktop (not the full task-* meta-package) plus a
+# complete developer toolchain.
+
+# ── base system ─────────────────────────────────────────────────────────────
+systemd
+systemd-sysv
+dbus
+libpam-systemd
+ca-certificates
+locales
+tzdata
+
+# ── boot ────────────────────────────────────────────────────────────────────
+grub-pc
+grub-efi-amd64
+shim-signed
+os-prober
+
+# ── kernel / firmware ───────────────────────────────────────────────────────
+linux-image-amd64
+firmware-linux-free
+firmware-misc-nonfree        # broadcom/intel wifi + gpu firmware
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+btrfs-progs
+snapper
+zstd
+xz-utils
+
+# ── desktop: X + KDE Plasma ─────────────────────────────────────────────────
+xserver-xorg
+xinit
+plasma-desktop
+sddm
+konsole
+dolphin
+kate
+ark
+gwenview
+plasma-discover
+network-manager
+network-manager-gnome
+pipewire
+pipewire-pulse
+wireplumber
+pulseaudio-utils
+
+# ── display / audio / input extras ──────────────────────────────────────────
+fonts-noto-core
+fonts-liberation
+firefox-esr
+
+# ── security / hardening ────────────────────────────────────────────────────
+openssh-server
+nftables
+apparmor
+apparmor-utils
+fail2ban
+
+# ── developer toolchain ─────────────────────────────────────────────────────
+build-essential
+gcc
+g++
+clang
+clang-format
+llvm
+lld
+gdb
+cmake
+ninja-build
+pkg-config
+golang-go
+rustc
+cargo
+python3
+python3-pip
+python3-venv
+nodejs
+npm
+git
+make
+curl
+wget
+jq
+vim
+nano
+htop
+tmux
+ripgrep
+fd-find
+bat
+docker.io
+podman
+runc
+containernetworking-plugins
+
+# ── Arcline toolchain (built from toolchain/) ───────────────────────────────
+# arcline-uptime arcline-check arcline-audit arcline-dns
+# arcline-vault arcline-email arcline-migrate arcline-billing
+# arcline-portal arcline-website arcline-status