feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/etc/nftables.conf

@@ -0,0 +1,44 @@
+#!/usr/sbin/nft -f
+# Arcline OS — default-deny firewall (nftables)
+# Every edition ships with this policy: drop inbound by default, allow only
+# what you opt in to. Services in `accept` rules are the baseline; add yours
+# with `nft add rule inet filter input tcp dport <port> accept` (or edit this
+# file and reload with `systemctl reload nftables`).
+
+flush ruleset
+
+table inet filter {
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        # established traffic is fine
+        ct state established,related accept
+        # loopback always
+        iif "lo" accept
+        # drop invalid packets early
+        ct state invalid drop
+
+        # ICMP (needed for PMTU discovery; rate-limited by kernel)
+        ip protocol icmp accept
+        ip6 nexthdr icmpv6 accept
+
+        # baseline services
+        # ssh (key-based auth only — see sshd_config.d)
+        tcp dport 22 accept
+        # web (commented out by default; enable when hosting)
+        # tcp dport 80 accept
+        # tcp dport 443 accept
+    }
+
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+        # containers route via their own bridge tables (docker/podman);
+        # this chain stays drop for anything else.
+    }
+
+    chain output {
+        type filter hook output priority filter; policy accept;
+        # zero telemetry means we never call out — but we don't block
+        # outgoing by default. Arcline never phones home on its own.
+    }
+}