feat: add production hardening — Ed25519 signing, Portainer Edge, SSH extension (Phase 4)

Image signing:
- Ed25519 sign/verify package (pure Go stdlib, zero deps)
- genkey and sign CLI subcommands for build system
- Optional --pubkey flag for verifying updates on apply
- Signature URLs in update metadata (latest.json)

Portainer Edge Agent:
- cloud-init portainer.go module writes K8s manifest
- Auto-deploys Edge Agent when portainer.edge-agent.enabled
- Full RBAC (ServiceAccount, ClusterRoleBinding, Deployment)
- 5 Portainer tests in portainer_test.go

Production tooling:
- SSH debug extension builder (hack/build-ssh-extension.sh)
- Boot performance benchmark (test/benchmark/bench-boot.sh)
- Resource usage benchmark (test/benchmark/bench-resources.sh)
- Deployment guide (docs/deployment-guide.md)

Test results: 50 update agent tests + 22 cloud-init tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -1,6 +1,7 @@
 .PHONY: all fetch build-cloudinit build-update-agent rootfs initramfs iso disk-image \
        test-boot test-k8s test-persistence test-deploy test-storage test-all \
        test-cloudinit test-update-agent \
+       bench-boot bench-resources \
        dev-vm dev-vm-shell quick docker-build shellcheck \
        kernel-audit clean distclean help
 
@@ -109,6 +110,15 @@ test-rollback: disk-image
 # Full integration test suite (requires more time)
 test-integration: test-k8s test-deploy test-storage
 
+# Benchmarks
+bench-boot: iso
+	@echo "==> Benchmarking boot performance..."
+	test/benchmark/bench-boot.sh $(OUTPUT_DIR)/$(OS_NAME)-$(VERSION).iso --runs 3
+
+bench-resources:
+	@echo "==> Benchmarking resource usage (requires running VM)..."
+	test/benchmark/bench-resources.sh
+
 # =============================================================================
 # Code quality
 # =============================================================================
@@ -197,6 +207,8 @@ help:
 	@echo "  make test-rollback      Forced rollback integration test"
 	@echo "  make test-all           Run core tests (boot + k8s + persistence)"
 	@echo "  make test-integ         Run full integration suite"
+	@echo "  make bench-boot         Benchmark boot performance (3 runs)"
+	@echo "  make bench-resources    Benchmark resource usage (requires running VM)"
 	@echo ""
 	@echo "Dev targets:"
 	@echo "  make dev-vm         Launch interactive QEMU VM"