feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/etc/modprobe.d/arcline-hardening.conf

@@ -0,0 +1,18 @@
+# Arcline OS — disabled kernel modules
+# Modules that add attack surface without being needed on the base system.
+# The workstation edition keeps most of these disabled too; hardware you
+# actually use can be re-enabled per-module.
+
+# exotic / historically-risky network protocols
+blacklist sctp
+blacklist dccp
+blacklist rds
+blacklist tipc
+
+# unneeded legacy filesystems (mountable by a user with local access)
+install cramfs /bin/false
+install freevxfs /bin/false
+install jffs2 /bin/false
+install hfs /bin/false
+install hfsplus /bin/false
+install udf /bin/false