docs: document disk images, installer, vendor packaging, and secure boot

- docs/secureboot.md: MOK workflow (generate, build, enroll).
- docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN.
- docs/observability.md: vendor .debs are now the primary packaging path.
- docs/editions.md: cloud ships a qcow2; qemu test command.
- docs/architecture.md: full pipeline table incl. deploy/install; the
  four follow-up items are now implemented; new "on the horizon" list.
- README: updated feature list, quickstart, and status.

docs/building.md

@@ -27,7 +27,9 @@ make check          # validate the tree (fast, offline, safe)
 make rootfs-server  # build just the server rootfs
 make iso-server     # build a bootable server ISO
 make iso            # build all three editions
+make image-cloud    # build the cloud edition as a qcow2 disk image
 make toolchain      # build the 11 Go tools into .deb
+make vendor         # build Grafana/Loki/Promtail .debs
 make test           # run smoke tests against built rootfs(es)
 ```
 
@@ -40,10 +42,30 @@ Everything lands under `build/`:
 | `build/rootfs/<edition>/` | extracted rootfs (from `make rootfs-*`) |
 | `build/artifacts/arcline-<edition>-<version>-<arch>.tar.xz` | archived rootfs |
 | `build/artifacts/arcline-<edition>-<version>-<arch>.iso` | bootable live ISO |
-| `build/debs/*.deb` | Arcline toolchain packages (from `make toolchain`) |
+| `build/artifacts/arcline-<edition>-<version>-<arch>.qcow2` | bootable disk image |
+| `build/debs/*.deb` | Arcline toolchain + vendor packages |
 
 Each artifact ships with a `.sha256` checksum file.
 
+## Disk images & installing
+
+- `make image-<edition>` builds a bootable **qcow2** disk image (the cloud
+  edition's primary output; also handy for VM-testing server/workstation).
+  Options: `--format raw`, `--size 4G`, `--boot efi`.
+- `scripts/install.sh /dev/sdX --edition server` installs a built rootfs onto
+  a real disk (asks for explicit confirmation, then partitions, lays out
+  btrfs subvolumes, installs GRUB, and writes a real fstab). Both reuse the
+  shared `scripts/deploy-disk.sh`.
+
+## Secure boot
+
+Optional, MOK-based. See [secureboot](secureboot.md):
+
+```bash
+scripts/secureboot/gen-keys.sh
+ARCLINE_SIGN=1 make iso-server
+```
+
 ## Reproducibility knobs
 
 Set these as environment variables or edit `versions.mk`:
@@ -58,6 +80,7 @@ Set these as environment variables or edit `versions.mk`:
 | `ARCLINE_LOCK_ROOT` | lock root account (`passwd -l root`) | `0` |
 | `ARCLINE_EXTRA_REPOS` | fetch grafana/loki upstream repos | `0` |
 | `ARCLINE_TOOLCHAIN` | toolchain in image builds | `auto` |
+| `ARCLINE_SIGN` | sign boot chain with the MOK (secure boot) | `0` |
 
 ## Building without the Arcline toolchain