feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/server/etc/prometheus/prometheus.yml

@@ -0,0 +1,25 @@
+# Arcline OS — Prometheus configuration (server edition)
+# Scrapes itself and node_exporter on the local host. Extension points for
+# the Arcline toolchain (arcline-uptime exposes :8081/metrics) are commented.
+
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+  external_labels:
+    cluster: arcline
+
+rule_files:
+  - /etc/prometheus/arcline.rules.yml
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  - job_name: node
+    static_configs:
+      - targets: ["localhost:9100"]
+
+  # - job_name: arcline-uptime
+  #   static_configs:
+  #     - targets: ["localhost:8081"]