fix: macOS dev VM, CA certs, DNS fallback, Portainer Edge integration

- dev-vm.sh: rewrite for macOS (bsdtar ISO extraction, Homebrew mkfs.ext4
  detection, direct kernel boot, TCG acceleration, port 8080 forwarding)
- inject-kubesolo.sh: add CA certificates bundle from builder so containerd
  can verify TLS when pulling from registries (Docker Hub, etc.)
- 50-network.sh: add DNS fallback (10.0.2.3 + 8.8.8.8) when DHCP client
  doesn't populate /etc/resolv.conf
- 90-kubesolo.sh: serve kubeconfig via HTTP on port 8080 for reliable
  retrieval from host, add 127.0.0.1 and 10.0.2.15 to API server SANs
- portainer.go: add headless Service to Edge Agent manifest (required for
  agent peer discovery DNS lookup)
- 10-parse-cmdline.sh + init.sh: add kubesolo.edge_id/edge_key boot params
- 20-persistent-mount.sh: auto-format unformatted data disks on first boot
- hack/fix-portainer-service.sh: helper to patch running cluster

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hack/fix-portainer-service.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# fix-portainer-service.sh — Create the missing headless Service for Portainer agent
+# Usage: ./hack/fix-portainer-service.sh
+#
+# The Portainer agent does a DNS lookup for "portainer-agent" to discover peers.
+# Without a Service, this lookup fails and the agent crashes.
+
+set -euo pipefail
+
+KUBECONFIG_URL="http://localhost:8080"
+
+echo "==> Fetching kubeconfig from $KUBECONFIG_URL..."
+KUBECONFIG_FILE=$(mktemp)
+trap 'rm -f "$KUBECONFIG_FILE"' EXIT
+
+curl -s "$KUBECONFIG_URL" > "$KUBECONFIG_FILE"
+
+if [ ! -s "$KUBECONFIG_FILE" ]; then
+    echo "ERROR: Failed to fetch kubeconfig. Is the VM running?"
+    exit 1
+fi
+
+echo "==> Creating headless Service for portainer-agent..."
+kubectl --kubeconfig "$KUBECONFIG_FILE" apply -f - <<'EOF'
+apiVersion: v1
+kind: Service
+metadata:
+  name: portainer-agent
+  namespace: portainer
+spec:
+  clusterIP: None
+  selector:
+    app: portainer-agent
+  ports:
+    - name: agent
+      port: 9001
+      targetPort: 9001
+      protocol: TCP
+EOF
+
+echo "==> Restarting portainer-agent deployment..."
+kubectl --kubeconfig "$KUBECONFIG_FILE" rollout restart -n portainer deployment/portainer-agent
+
+echo "==> Waiting for rollout..."
+kubectl --kubeconfig "$KUBECONFIG_FILE" rollout status -n portainer deployment/portainer-agent --timeout=120s
+
+echo "==> Done. Checking pod status:"
+kubectl --kubeconfig "$KUBECONFIG_FILE" get pods -n portainer