feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/base/usr/lib/systemd/system/arcline-snapshot.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Arcline btrfs snapshot
+Documentation=file:///usr/local/sbin/arcline-snapshot
+RequiresMountsFor=/.snapshots
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/arcline-snapshot snapshot
+
+[Install]
+WantedBy=multi-user.target

overlays/base/usr/lib/systemd/system/arcline-snapshot.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily Arcline btrfs snapshot
+Requires=arcline-snapshot.service
+
+[Timer]
+OnCalendar=*-*-* 03:00:00
+Persistent=true
+RandomizedDelaySec=300
+
+[Install]
+WantedBy=timers.target