docs: document disk images, installer, vendor packaging, and secure boot

- docs/secureboot.md: MOK workflow (generate, build, enroll).
- docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN.
- docs/observability.md: vendor .debs are now the primary packaging path.
- docs/editions.md: cloud ships a qcow2; qemu test command.
- docs/architecture.md: full pipeline table incl. deploy/install; the
  four follow-up items are now implemented; new "on the horizon" list.
- README: updated feature list, quickstart, and status.

docs/architecture.md

@@ -35,16 +35,20 @@ Pipeline stages live in `scripts/`:
 | overlay | `apply-overlays.sh` | copies `overlays/base` + `overlays/<edition>` into the rootfs |
 | configure | `configure-system.sh` | runs *in the chroot*: hostname, locale, kernel cmdline, services, live-boot, toolchain |
 | package | `build-iso.sh` | kernel + initramfs + squashfs → hybrid BIOS/UEFI ISO |
+| image | `build-image.sh` | rootfs → bootable qcow2/raw disk image (via `deploy-disk.sh`) |
+| deploy | `deploy-disk.sh` | partition → btrfs layout → copy rootfs → GRUB + fstab (shared by image + installer) |
+| install | `install.sh` | scripted installer for a real disk (confirmation-gated) |
 | orchestrate | `build-edition.sh` / `Makefile` | wire the above to `make iso-<edition>` |
 
-## The four source trees
+## The source trees
 
 | Path | Role |
 |------|------|
 | `editions/` | per-edition **manifests**: package lists, kernel cmdline, fstab, metadata |
 | `overlays/` | **files that land in the image**, organised as layered rootfs trees |
 | `scripts/` | the **build pipeline** (all plain bash, readable top to bottom) |
-| `btrfs/`, `toolchain/`, `observability/`, `tests/`, `ci/` | supporting subsystems |
+| `btrfs/`, `toolchain/`, `tests/`, `ci/` | supporting subsystems |
+| `scripts/secureboot/` | MOK key generation + boot-chain signing (optional) |
 
 There is no hidden magic: the Makefile is a thin wrapper, `versions.mk` /
 `scripts/common.sh` hold the single source of truth for versions and paths.
@@ -59,10 +63,23 @@ There is no hidden magic: the Makefile is a thin wrapper, `versions.mk` /
 - The smoke tests (`tests/smoke/verify-rootfs.sh`) fail the build if telemetry
   artifacts are found.
 
-## Follow-up work (explicitly out of scope for "the wires")
+## What "the wires" now covers
 
-- Partitioning/installer that runs `btrfs/init.sh` on a target disk.
-- Cloud images (qcow2/raw) for the `cloud` edition — the ISO path is wired,
-  a disk-image path is the next step.
-- Grafana/Loki packaged as `.deb`s rather than fetched from upstream.
-- A signed (secure-boot) kernel for official releases.
+The four original follow-up items are implemented:
+
+1. **Disk images** — `make image-<edition>` produces bootable qcow2/raw images;
+   the cloud edition ships as a qcow2 by default.
+2. **Installer** — `scripts/install.sh <device>` installs to a real disk
+   (explicit confirmation, reuses the deploy module).
+3. **Grafana/Loki/Promtail `.debs`** — `make vendor` packages them so the full
+   observability stack installs without upstream repos.
+4. **Secure boot** — MOK-based signing (`scripts/secureboot/`), off by
+   default, enabled with `ARCLINE_SIGN=1`.
+
+## Still on the horizon
+
+- A signed Microsoft-KEK boot chain (only relevant for commercial
+  distribution; the MOK path covers self-hosted use).
+- ARM64 (`arm64`) as a first-class arch (one-line change in `versions.mk`).
+- Boot-time verification tests for installed systems (the smoke tests cover
+  the image contents, not a booted VM yet).