feat: custom kernel build + boot fixes for working container runtime

Build a custom Tiny Core 17.0 kernel (6.18.2) with missing configs
that the stock kernel lacks for container workloads:
- CONFIG_CGROUP_BPF=y (cgroup v2 device control via BPF)
- CONFIG_DEVTMPFS=y (auto-create /dev device nodes)
- CONFIG_DEVTMPFS_MOUNT=y (auto-mount devtmpfs)
- CONFIG_MEMCG=y (memory cgroup controller for memory.max)
- CONFIG_CFS_BANDWIDTH=y (CPU bandwidth throttling for cpu.max)

Also strips unnecessary subsystems (sound, GPU, wireless, Bluetooth,
KVM, etc.) for minimal footprint on a headless K8s edge appliance.

Init system fixes for successful boot-to-running-pods:
- Add switch_root in init.sh to escape initramfs (runc pivot_root)
- Add mountpoint guards in 00-early-mount.sh (skip if already mounted)
- Create essential device nodes after switch_root (kmsg, console, etc.)
- Enable cgroup v2 controller delegation with init process isolation
- Mount BPF filesystem for cgroup v2 device control
- Add mknod fallback from sysfs in 20-persistent-mount.sh for /dev/vda
- Move KubeSolo binary to /usr/bin (avoid /usr/local bind mount hiding)
- Generate /etc/machine-id in 60-hostname.sh (kubelet requires it)
- Pre-initialize iptables tables before kube-proxy starts
- Add nft_reject, nft_fib, xt_nfacct to kernel modules list

Build system changes:
- New build-kernel.sh script for custom kernel compilation
- Dockerfile.builder adds kernel build deps (flex, bison, libelf, etc.)
- Selective kernel module install (only modules.list + transitive deps)
- Install iptables-nft (xtables-nft-multi) + shared libs in rootfs

Tested: ISO boots in QEMU, node reaches Ready in ~35s, CoreDNS and
local-path-provisioner pods start and run successfully.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

init/lib/90-kubesolo.sh

@@ -4,7 +4,7 @@
 # This stage exec's KubeSolo as PID 1 (replacing init).
 # KubeSolo manages containerd, kubelet, API server, and all K8s components.
 
-KUBESOLO_BIN="/usr/local/bin/kubesolo"
+KUBESOLO_BIN="/usr/bin/kubesolo"
 
 if [ ! -x "$KUBESOLO_BIN" ]; then
     log_err "KubeSolo binary not found at $KUBESOLO_BIN"
@@ -12,7 +12,7 @@ if [ ! -x "$KUBESOLO_BIN" ]; then
 fi
 
 # Build KubeSolo command line
-KUBESOLO_ARGS="--path /var/lib/kubesolo --local-storage true"
+KUBESOLO_ARGS="--path /var/lib/kubesolo --local-storage"
 
 # Add extra SANs if hostname resolves
 HOSTNAME="$(hostname)"
@@ -30,6 +30,17 @@ if [ -f /etc/kubesolo/extra-flags ]; then
     KUBESOLO_ARGS="$KUBESOLO_ARGS $(cat /etc/kubesolo/extra-flags)"
 fi
 
+# Pre-initialize iptables filter table and base chains.
+# KubeSolo's kube-proxy uses iptables-restore (nf_tables backend) which needs
+# the filter table to exist. Without this, the first iptables-restore fails
+# with "RULE_APPEND failed (No such file or directory)".
+if command -v iptables >/dev/null 2>&1; then
+    iptables -t filter -L -n >/dev/null 2>&1 || true
+    iptables -t nat -L -n >/dev/null 2>&1 || true
+    iptables -t mangle -L -n >/dev/null 2>&1 || true
+    log "Pre-initialized iptables tables (filter, nat, mangle)"
+fi
+
 log "Starting KubeSolo: $KUBESOLO_BIN $KUBESOLO_ARGS"
 log "Kubeconfig will be at: /var/lib/kubesolo/pki/admin/admin.kubeconfig"