fix: macOS dev VM, CA certs, DNS fallback, Portainer Edge integration

- dev-vm.sh: rewrite for macOS (bsdtar ISO extraction, Homebrew mkfs.ext4
  detection, direct kernel boot, TCG acceleration, port 8080 forwarding)
- inject-kubesolo.sh: add CA certificates bundle from builder so containerd
  can verify TLS when pulling from registries (Docker Hub, etc.)
- 50-network.sh: add DNS fallback (10.0.2.3 + 8.8.8.8) when DHCP client
  doesn't populate /etc/resolv.conf
- 90-kubesolo.sh: serve kubeconfig via HTTP on port 8080 for reliable
  retrieval from host, add 127.0.0.1 and 10.0.2.15 to API server SANs
- portainer.go: add headless Service to Edge Agent manifest (required for
  agent peer discovery DNS lookup)
- 10-parse-cmdline.sh + init.sh: add kubesolo.edge_id/edge_key boot params
- 20-persistent-mount.sh: auto-format unformatted data disks on first boot
- hack/fix-portainer-service.sh: helper to patch running cluster

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

init/lib/20-persistent-mount.sh

@@ -36,12 +36,19 @@ if [ ! -b "$KUBESOLO_DATA_DEV" ]; then
     return 1
 fi
 
-# Mount data partition
+# Mount data partition (format on first boot if unformatted)
 mkdir -p "$DATA_MOUNT"
-mount -t ext4 -o noatime "$KUBESOLO_DATA_DEV" "$DATA_MOUNT" || {
-    log_err "Failed to mount $KUBESOLO_DATA_DEV"
-    return 1
-}
+if ! mount -t ext4 -o noatime "$KUBESOLO_DATA_DEV" "$DATA_MOUNT" 2>/dev/null; then
+    log "Formatting $KUBESOLO_DATA_DEV as ext4 (first boot)"
+    mkfs.ext4 -q -L KSOLODATA "$KUBESOLO_DATA_DEV" || {
+        log_err "Failed to format $KUBESOLO_DATA_DEV"
+        return 1
+    }
+    mount -t ext4 -o noatime "$KUBESOLO_DATA_DEV" "$DATA_MOUNT" || {
+        log_err "Failed to mount $KUBESOLO_DATA_DEV after format"
+        return 1
+    }
+fi
 log_ok "Mounted $KUBESOLO_DATA_DEV at $DATA_MOUNT"
 
 # Create persistent directory structure (first boot)