fix: macOS dev VM, CA certs, DNS fallback, Portainer Edge integration

- dev-vm.sh: rewrite for macOS (bsdtar ISO extraction, Homebrew mkfs.ext4
  detection, direct kernel boot, TCG acceleration, port 8080 forwarding)
- inject-kubesolo.sh: add CA certificates bundle from builder so containerd
  can verify TLS when pulling from registries (Docker Hub, etc.)
- 50-network.sh: add DNS fallback (10.0.2.3 + 8.8.8.8) when DHCP client
  doesn't populate /etc/resolv.conf
- 90-kubesolo.sh: serve kubeconfig via HTTP on port 8080 for reliable
  retrieval from host, add 127.0.0.1 and 10.0.2.15 to API server SANs
- portainer.go: add headless Service to Edge Agent manifest (required for
  agent peer discovery DNS lookup)
- 10-parse-cmdline.sh + init.sh: add kubesolo.edge_id/edge_key boot params
- 20-persistent-mount.sh: auto-format unformatted data disks on first boot
- hack/fix-portainer-service.sh: helper to patch running cluster

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

init/lib/90-kubesolo.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 # 90-kubesolo.sh — Start KubeSolo (final init stage)
 #
-# This stage exec's KubeSolo as PID 1 (replacing init).
-# KubeSolo manages containerd, kubelet, API server, and all K8s components.
+# Starts KubeSolo, waits for it to become ready, then prints the kubeconfig
+# to the console so it can be copied for remote kubectl access.
 
 KUBESOLO_BIN="/usr/bin/kubesolo"
 
@@ -14,11 +14,13 @@ fi
 # Build KubeSolo command line
 KUBESOLO_ARGS="--path /var/lib/kubesolo --local-storage"
 
-# Add extra SANs if hostname resolves
+# Add SANs for remote access (127.0.0.1 for QEMU port forwarding, 10.0.2.15 for QEMU NAT)
+EXTRA_SANS="127.0.0.1,10.0.2.15"
 HOSTNAME="$(hostname)"
 if [ -n "$HOSTNAME" ]; then
-    KUBESOLO_ARGS="$KUBESOLO_ARGS --apiserver-extra-sans $HOSTNAME"
+    EXTRA_SANS="$EXTRA_SANS,$HOSTNAME"
 fi
+KUBESOLO_ARGS="$KUBESOLO_ARGS --apiserver-extra-sans $EXTRA_SANS"
 
 # Add any extra flags from boot parameters
 if [ -n "$KUBESOLO_EXTRA_FLAGS" ]; then
@@ -41,9 +43,66 @@ if command -v iptables >/dev/null 2>&1; then
     log "Pre-initialized iptables tables (filter, nat, mangle)"
 fi
 
-log "Starting KubeSolo: $KUBESOLO_BIN $KUBESOLO_ARGS"
-log "Kubeconfig will be at: /var/lib/kubesolo/pki/admin/admin.kubeconfig"
+# Export Portainer Edge env vars if set (via boot params or cloud-init)
+if [ -n "${KUBESOLO_PORTAINER_EDGE_ID:-}" ]; then
+    export KUBESOLO_PORTAINER_EDGE_ID
+    log "Portainer Edge ID configured"
+fi
+if [ -n "${KUBESOLO_PORTAINER_EDGE_KEY:-}" ]; then
+    export KUBESOLO_PORTAINER_EDGE_KEY
+    log "Portainer Edge Key configured"
+fi
 
-# exec replaces this init process — KubeSolo becomes PID 1
+log "Starting KubeSolo: $KUBESOLO_BIN $KUBESOLO_ARGS"
+
+KUBECONFIG_PATH="/var/lib/kubesolo/pki/admin/admin.kubeconfig"
+
+# Start KubeSolo in background so we can wait for readiness and print kubeconfig
 # shellcheck disable=SC2086
-exec $KUBESOLO_BIN $KUBESOLO_ARGS
+$KUBESOLO_BIN $KUBESOLO_ARGS &
+KUBESOLO_PID=$!
+
+# Wait for kubeconfig to appear (KubeSolo generates it during startup)
+log "Waiting for KubeSolo to generate kubeconfig..."
+WAIT=0
+while [ ! -f "$KUBECONFIG_PATH" ] && [ $WAIT -lt 120 ]; do
+    sleep 2
+    WAIT=$((WAIT + 2))
+    # Check KubeSolo is still running
+    if ! kill -0 $KUBESOLO_PID 2>/dev/null; then
+        log_err "KubeSolo exited unexpectedly"
+        wait $KUBESOLO_PID 2>/dev/null || true
+        return 1
+    fi
+done
+
+if [ -f "$KUBECONFIG_PATH" ]; then
+    log_ok "KubeSolo is running (PID $KUBESOLO_PID)"
+
+    # Rewrite server URL for external access and serve via HTTP.
+    # Serial console truncates long base64 cert lines, so we serve
+    # the kubeconfig over HTTP for reliable retrieval.
+    EXTERNAL_KC="/tmp/kubeconfig-external.yaml"
+    sed 's|server: https://.*:6443|server: https://localhost:6443|' "$KUBECONFIG_PATH" > "$EXTERNAL_KC"
+
+    # Serve kubeconfig via HTTP on port 8080 using BusyBox nc
+    (while true; do
+        printf "HTTP/1.1 200 OK\r\nContent-Type: text/yaml\r\nConnection: close\r\n\r\n" | cat - "$EXTERNAL_KC" | nc -l -p 8080 2>/dev/null
+    done) &
+
+    log_ok "Kubeconfig available via HTTP"
+    echo ""
+    echo "============================================================"
+    echo "  From your host machine, run:"
+    echo ""
+    echo "  curl -s http://localhost:8080 > ~/.kube/kubesolo-config"
+    echo "  kubectl --kubeconfig ~/.kube/kubesolo-config get nodes"
+    echo "============================================================"
+    echo ""
+else
+    log_warn "Kubeconfig not found after ${WAIT}s — KubeSolo may still be starting"
+    log_warn "Check manually: cat $KUBECONFIG_PATH"
+fi
+
+# Keep init alive — wait on KubeSolo process
+wait $KUBESOLO_PID