docs: add architecture, hardening, and building documentation

Document the design and how to operate it: architecture, building
(including toolchain-free/minimal builds), hardening guide, editions,
observability, and the toolchain. README ties it together.

docs/editions.md

@@ -0,0 +1,44 @@
+# Editions
+
+Three flavours, one hardened base. Each is defined entirely by its manifest
+under `editions/<name>/`.
+
+| Edition | Codename | Purpose | Kernel | Notes |
+|---------|----------|---------|--------|-------|
+| `server` | bastion | production server | generic (`linux-image-amd64`) | full observability stack, containers |
+| `workstation` | forge | hardened daily driver | generic | KDE Plasma, dev toolchains |
+| `cloud` | nimbus | cloud images | cloud (`linux-image-cloud-amd64`) | cloud-init, guest agents |
+
+## What an edition manifest contains
+
+```
+editions/<name>/
+├── metadata.yaml    # codename, summary, image type, services to enable/mask
+├── packages.list    # Debian packages (comments allowed)
+├── kernel.cmdline   # boot parameters for this edition
+└── fstab            # /etc/fstab template (btrfs subvolumes, UUID placeholder)
+```
+
+Edition-specific configs that land in the image live in `overlays/<name>/` and
+are layered **after** `overlays/base/`, so they win conflicts.
+
+## server — bastion
+
+The flagship. Hardened base + Docker/Podman + Prometheus/Grafana/Loki
+pre-configured (`overlays/server/etc/prometheus|grafana|loki|promtail`). Ships
+the full Arcline toolchain. Serial console for headless boxes.
+
+## workstation — forge
+
+Same hardening baseline, relaxed only where a developer needs it (`perf`,
+rootless containers). Curated KDE Plasma (not the full task meta-package),
+dev toolchains (Go, Rust, Python, Node, clang/LLVM, CMake/Ninja), containers,
+and privacy-oriented defaults.
+
+## cloud — nimbus
+
+Minimal footprint: cloud kernel, cloud-init (NoCloud/ConfigDrive/EC2/GCE/
+Azure), guest agents (qemu/vmware), NVMe + iSCSI + multipath tooling.
+`net.ifnames=0` for predictable, provider-friendly interface naming. The
+disk-image (qcow2) output path is the next milestone — the manifest is ready,
+the ISO path is wired today.