feat: add hardened base and per-edition image overlays

Add the files that land in the image, organised as layered rootfs trees
(base first, then the edition layer wins on conflict).

- base: hardened kernel cmdline + sysctl, default-deny nftables,
  key-only ssh, persistent journald, module blacklist, no core dumps,
  snapshot timer units, motd.
- server: Prometheus + auto-provisioned Grafana + Loki + promtail.
- workstation: dev profile and desktop sysctl relaxations (perf,
  rootless containers).
- cloud: cloud-init provisioning config.

overlays/workstation/etc/sysctl.d/90-arcline-desktop.conf

@@ -0,0 +1,12 @@
+# Arcline Workstation — desktop relaxation overrides
+# The base hardening is strict (perf_event_paranoid=3 blocks `perf` for
+# unprivileged users). A workstation developer wants perf, tracing, and
+# unprivileged user namespaces (used by podman/rootless containers). These
+# lines land AFTER the base file, so they win.
+
+kernel.perf_event_paranoid=1
+kernel.unprivileged_bpf_disabled=0
+kernel.yama.ptrace_scope=0
+
+# rootless containers
+kernel.unprivileged_userns_clone=1