docs: document disk images, installer, vendor packaging, and secure boot

- docs/secureboot.md: MOK workflow (generate, build, enroll).
- docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN.
- docs/observability.md: vendor .debs are now the primary packaging path.
- docs/editions.md: cloud ships a qcow2; qemu test command.
- docs/architecture.md: full pipeline table incl. deploy/install; the
  four follow-up items are now implemented; new "on the horizon" list.
- README: updated feature list, quickstart, and status.

README.md

@@ -12,6 +12,9 @@ manifests into hardened, bootable operating system images for three editions:
 
 - A transparent, script-based build pipeline (no magic, everything auditable)
 - `debootstrap` → package install → overlay → in-chroot configure → live ISO
+- **Disk images + installer**: `make image-<edition>` builds bootable qcow2/raw
+  images; `scripts/install.sh` installs to a real disk (both share the
+  `deploy-disk.sh` core: partition → btrfs layout → GRUB → real fstab)
 - **Secure by default**: hardened kernel cmdline + sysctl, default-deny
   nftables, key-only ssh, AppArmor, no core dumps
 - **btrfs-native**: subvolume layout, scheduled read-only snapshots, and
@@ -19,9 +22,12 @@ manifests into hardened, bootable operating system images for three editions:
 - **Zero telemetry**: enforced by package selection, masked apt timers, and
   smoke tests that fail the build if telemetry is found
 - **Pre-configured observability** (server): Prometheus + node_exporter +
-  Grafana (auto-provisioned) + Loki + promtail, local-only
+  Grafana (auto-provisioned) + Loki + promtail, local-only — Grafana/Loki/
+  promtail packaged as `.debs` by `make vendor`
 - **The Arcline toolchain**: a harness that packages all 11 Go tools into
   `.deb`s and installs them into the image
+- **Optional secure boot**: MOK-based signing of the boot chain
+  (`ARCLINE_SIGN=1`)
 - Smoke tests, GitLab CI, and docs that explain every decision
 
 ## Quickstart
@@ -32,7 +38,9 @@ make deps              # install host build dependencies
 make check             # validate the tree (fast, offline)
 make iso-server        # build a bootable server ISO
 make iso               # build all three editions
+make image-cloud       # cloud edition as a qcow2 disk image
 make toolchain         # build the 11 Go tools into .deb
+make vendor            # build grafana/loki/promtail .debs
 make iso-server-minimal # server ISO WITHOUT the Arcline toolchain
 make test              # run smoke tests against built rootfs(es)
 ```
@@ -69,15 +77,16 @@ os-build/
 | [editions](docs/editions.md) | server / workstation / cloud manifests |
 | [observability](docs/observability.md) | the pre-configured monitoring stack |
 | [toolchain](docs/toolchain.md) | the 11 Go tools and their packaging |
+| [secureboot](docs/secureboot.md) | MOK key generation + signing workflow |
 | [btrfs](btrfs/README.md) | subvolume layout + snapshots + rollback |
 
 ## Status
 
-This is the **foundation**: the build pipeline, edition manifests, hardening
-baseline, btrfs tooling, observability configs, tests, and CI are in place and
-runnable. The next milestones (installer that writes the btrfs layout to disk,
-cloud disk images, signed releases) are listed in
-[docs/architecture.md](docs/architecture.md#follow-up-work).
+The build pipeline, edition manifests, hardening baseline, btrfs tooling,
+observability packaging, disk images + installer, tests, CI, and optional
+secure boot are all in place and runnable. What's next: a Microsoft-KEK signed
+boot chain (only relevant for commercial distribution), `arm64` support, and
+booted-VM verification tests.
 
 ## License