fix: macOS dev VM, CA certs, DNS fallback, Portainer Edge integration

- dev-vm.sh: rewrite for macOS (bsdtar ISO extraction, Homebrew mkfs.ext4
  detection, direct kernel boot, TCG acceleration, port 8080 forwarding)
- inject-kubesolo.sh: add CA certificates bundle from builder so containerd
  can verify TLS when pulling from registries (Docker Hub, etc.)
- 50-network.sh: add DNS fallback (10.0.2.3 + 8.8.8.8) when DHCP client
  doesn't populate /etc/resolv.conf
- 90-kubesolo.sh: serve kubeconfig via HTTP on port 8080 for reliable
  retrieval from host, add 127.0.0.1 and 10.0.2.15 to API server SANs
- portainer.go: add headless Service to Edge Agent manifest (required for
  agent peer discovery DNS lookup)
- 10-parse-cmdline.sh + init.sh: add kubesolo.edge_id/edge_key boot params
- 20-persistent-mount.sh: auto-format unformatted data disks on first boot
- hack/fix-portainer-service.sh: helper to patch running cluster

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

init/lib/50-network.sh

@@ -58,4 +58,16 @@ else
     return 1
 fi
 
-log_ok "Network configured on $ETH_DEV"
+# Ensure /etc/resolv.conf has valid DNS (udhcpc should have written it,
+# but verify and add fallbacks if missing)
+if [ ! -s /etc/resolv.conf ]; then
+    log_warn "/etc/resolv.conf is empty — adding fallback DNS"
+    echo "nameserver 10.0.2.3" > /etc/resolv.conf
+    echo "nameserver 8.8.8.8" >> /etc/resolv.conf
+elif ! grep -q nameserver /etc/resolv.conf 2>/dev/null; then
+    log_warn "No nameserver in /etc/resolv.conf — adding fallback DNS"
+    echo "nameserver 10.0.2.3" >> /etc/resolv.conf
+    echo "nameserver 8.8.8.8" >> /etc/resolv.conf
+fi
+
+log_ok "Network configured on $ETH_DEV (DNS: $(grep nameserver /etc/resolv.conf 2>/dev/null | head -1))"