feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/workstation/etc/profile.d/arcline-dev.sh

@@ -0,0 +1,12 @@
+# Arcline Workstation — developer environment (profile.d)
+# Standard Go / Rust / Node paths for every login shell.
+
+# Go
+export GOPATH="$HOME/go"
+export PATH="$PATH:/usr/local/go/bin:$GOPATH/bin"
+
+# Rust (rustup installs to ~/.cargo)
+export PATH="$PATH:$HOME/.cargo/bin"
+
+# Node
+export PATH="$PATH:./node_modules/.bin"