docs: document disk images, installer, vendor packaging, and secure boot

- docs/secureboot.md: MOK workflow (generate, build, enroll).
- docs/building.md: image + install quickstart, new outputs, ARCLINE_SIGN.
- docs/observability.md: vendor .debs are now the primary packaging path.
- docs/editions.md: cloud ships a qcow2; qemu test command.
- docs/architecture.md: full pipeline table incl. deploy/install; the
  four follow-up items are now implemented; new "on the horizon" list.
- README: updated feature list, quickstart, and status.

docs/observability.md

@@ -32,16 +32,26 @@ service.
 ## Packaging note
 
 Prometheus + node_exporter + alertmanager are in Debian main and install with
-the edition packages. **Grafana** and **Loki** are not:
+the edition packages. **Grafana**, **Loki**, and **Promtail** are not — but
+they're now packaged as `.debs` by `toolchain/build-vendor.sh`:
 
-- Grafana is available via the official `apt.grafana.com` repo — add it by
-  setting `ARCLINE_EXTRA_REPOS=1` during the build
-  (`configure-system.sh` adds the repo + key).
-- Loki ships as a static binary tarball; the packaging (a `.deb` in
-  `toolchain/`) is follow-up work.
+```bash
+make vendor    # → build/debs/grafana_<v>_amd64.deb, arcline-loki_<v>.deb, arcline-promtail_<v>.deb
+make iso-server
+```
 
-Until then, the Grafana/Loki configs ship dormant in the image, ready for when
-the binaries are installed — the `overlays/server` configs are the contract.
+The debs land in `build/debs/` alongside the toolchain, so the next rootfs
+build picks them up automatically and the configure hook enables
+`grafana-server` / `loki` / `promtail` when their binaries are present.
+
+- `grafana` — the official OSS `.deb` from `dl.grafana.com`, vendored as-is.
+- `arcline-loki` / `arcline-promtail` — static binaries from the Loki GitHub
+  release, wrapped in minimal debs that install the configs from
+  `overlays/server/etc/` and systemd units from `toolchain/vendor/`.
+
+If the downloads fail (no network / version bumped), the build skips them with
+a warning — the old `ARCLINE_EXTRA_REPOS=1` path (apt.grafana.com) remains as
+a fallback.
 
 ## Access