feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/etc/sysctl.d/10-arcline-hardening.conf

@@ -0,0 +1,52 @@
+# Arcline OS — kernel hardening (sysctl)
+# Applies to every edition via the base overlay. Conservative defaults;
+# the workstation edition relaxes a couple of entries (see overlays/workstation).
+
+# ── memory ──────────────────────────────────────────────────────────────────
+vm.swappiness=10
+vm.overcommit_memory=2
+vm.dirty_ratio=5
+vm.dirty_background_ratio=2
+
+# ── networking ──────────────────────────────────────────────────────────────
+# strict reverse-path filtering
+net.ipv4.conf.all.rp_filter=1
+net.ipv4.conf.default.rp_filter=1
+# no ICMP redirects
+net.ipv4.conf.all.accept_redirects=0
+net.ipv4.conf.default.accept_redirects=0
+net.ipv4.conf.all.secure_redirects=0
+net.ipv4.conf.default.secure_redirects=0
+net.ipv4.conf.all.send_redirects=0
+net.ipv4.conf.default.send_redirects=0
+net.ipv6.conf.all.accept_redirects=0
+net.ipv6.conf.default.accept_redirects=0
+# ICMP hardening
+net.ipv4.icmp_echo_ignore_broadcasts=1
+net.ipv4.icmp_ignore_bogus_error_responses=1
+# TCP hardening
+net.ipv4.tcp_syncookies=1
+net.ipv4.tcp_rfc1337=1
+net.ipv4.tcp_timestamps=0
+net.ipv4.conf.all.log_martians=1
+net.ipv4.conf.default.log_martians=1
+# IPv6: don't auto-accept router advertisements
+net.ipv6.conf.all.accept_ra=0
+net.ipv6.conf.default.accept_ra=0
+
+# ── kernel / visibility ─────────────────────────────────────────────────────
+kernel.dmesg_restrict=1
+kernel.kptr_restrict=2
+kernel.perf_event_paranoid=3
+kernel.yama.ptrace_scope=1
+kernel.core_uses_pid=1
+kernel.unprivileged_bpf_disabled=1
+kernel.randomize_va_space=2
+kernel.sysrq=4
+
+# ── filesystem hardening ────────────────────────────────────────────────────
+fs.protected_hardlinks=1
+fs.protected_symlinks=1
+fs.protected_fifos=2
+fs.protected_regular=2
+fs.suid_dumpable=0