feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/etc/systemd/journald.conf.d/10-arcline.conf

@@ -0,0 +1,12 @@
+# Arcline OS — journald
+# Persistent, bounded, compressed logs. Logs live on @log so they survive
+# system rollbacks (see btrfs/README.md).
+
+[Journal]
+Storage=persistent
+Compress=yes
+SystemMaxUse=500M
+SystemMaxFileSize=100M
+MaxRetentionSec=14day
+ForwardToSyslog=no
+ForwardToConsole=no

overlays/base/etc/systemd/system.conf.d/10-arcline.conf

@@ -0,0 +1,9 @@
+# Arcline OS — systemd manager hardening
+# Global defaults applied to every unit. No core dumps on disk, sane limits.
+
+[Manager]
+DefaultLimitNOFILE=65535
+DefaultLimitNPROC=4096
+DefaultLimitCORE=0
+DumpCore=no
+CoreDumpSize=0