feat: add production hardening — Ed25519 signing, Portainer Edge, SSH extension (Phase 4)

Image signing:
- Ed25519 sign/verify package (pure Go stdlib, zero deps)
- genkey and sign CLI subcommands for build system
- Optional --pubkey flag for verifying updates on apply
- Signature URLs in update metadata (latest.json)

Portainer Edge Agent:
- cloud-init portainer.go module writes K8s manifest
- Auto-deploys Edge Agent when portainer.edge-agent.enabled
- Full RBAC (ServiceAccount, ClusterRoleBinding, Deployment)
- 5 Portainer tests in portainer_test.go

Production tooling:
- SSH debug extension builder (hack/build-ssh-extension.sh)
- Boot performance benchmark (test/benchmark/bench-boot.sh)
- Resource usage benchmark (test/benchmark/bench-resources.sh)
- Deployment guide (docs/deployment-guide.md)

Test results: 50 update agent tests + 22 cloud-init tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

update/main.go

@@ -8,6 +8,8 @@
 //	kubesolo-update rollback       Force rollback to other partition
 //	kubesolo-update healthcheck    Post-boot health verification
 //	kubesolo-update status         Show current A/B slot and boot status
+//	kubesolo-update sign           Sign update artifacts with Ed25519 key
+//	kubesolo-update genkey         Generate new Ed25519 signing key pair
 package main
 
 import (
@@ -42,6 +44,10 @@ func main() {
 		err = cmd.Healthcheck(os.Args[2:])
 	case "status":
 		err = cmd.Status(os.Args[2:])
+	case "sign":
+		err = cmd.Sign(os.Args[2:])
+	case "genkey":
+		err = cmd.GenKey(os.Args[2:])
 	default:
 		fmt.Fprintf(os.Stderr, "unknown command: %s\n\n", os.Args[1])
 		usage()
@@ -64,15 +70,18 @@ Commands:
   rollback     Force rollback to other partition
   healthcheck  Post-boot health verification (marks boot successful)
   status       Show current A/B slot and boot status
+  sign         Sign artifacts with Ed25519 private key (build system)
+  genkey       Generate new Ed25519 signing key pair
 
 Options:
   --server URL     Update server URL (default: from /etc/kubesolo/update.conf)
   --grubenv PATH   Path to grubenv file (default: /boot/grub/grubenv)
   --timeout SECS   Health check timeout in seconds (default: 120)
+  --pubkey PATH    Ed25519 public key for signature verification (optional)
 
 Examples:
   kubesolo-update check --server https://updates.example.com
-  kubesolo-update apply --server https://updates.example.com
+  kubesolo-update apply --server https://updates.example.com --pubkey /etc/kubesolo/update-pubkey.hex
   kubesolo-update healthcheck
   kubesolo-update status
 `)