feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/cloud/etc/cloud/cloud.cfg

@@ -0,0 +1,41 @@
+# Arcline OS — cloud-init configuration (cloud edition)
+# Minimal, deterministic first-boot provisioning. No telemetry: cloud-init is
+# pointed only at the configured datasource and never phones home.
+
+# hostname
+preserve_hostname: false
+hostname: arclines
+fqdn: arclines.local
+
+# datasource: auto-detected (aws, gce, azure, openstack, hetzner, ...)
+datasource_list: [ NoCloud, ConfigDrive, OpenStack, Ec2, GCE, Azure, Hetzner, None ]
+datasource:
+  Ec2:
+    strict_id: false
+    metadata_urls: ["http://169.254.169.254"]
+
+# only the arcline user is guaranteed; everything else comes from user-data
+system_info:
+  default_user:
+    name: arcline
+    lock_passwd: true
+    gecos: Arcline Cloud User
+    groups: [adm, sudo, systemd-journal]
+    sudo: ["ALL=(ALL) NOPASSWD:ALL"]
+    shell: /bin/bash
+
+# disable cloud-init's own telemetry/reporting
+reporting:
+  logging:
+    type: log
+
+# grow root partition on first boot (cloud volumes)
+growpart:
+  mode: auto
+  devices: ["/"]
+
+resize_rootfs: true
+
+# keep ssh config managed by Arcline, not cloud-init
+ssh_genkeytypes: ["ed25519"]
+disable_ec2_metadata: false