feat: initial Phase 1 PoC scaffolding for KubeSolo OS

Complete Phase 1 implementation of KubeSolo OS — an immutable, bootable
Linux distribution built on Tiny Core Linux for running KubeSolo
single-node Kubernetes.

Build system:
- Makefile with fetch, rootfs, initramfs, iso, disk-image targets
- Dockerfile.builder for reproducible builds
- Scripts to download Tiny Core, extract rootfs, inject KubeSolo,
  pack initramfs, and create bootable ISO/disk images

Init system (10 POSIX sh stages):
- Early mount (proc/sys/dev/cgroup2), cmdline parsing, persistent
  mount with bind-mounts, kernel module loading, sysctl, DHCP
  networking, hostname, clock sync, containerd prep, KubeSolo exec

Shared libraries:
- functions.sh (device wait, IP lookup, config helpers)
- network.sh (static IP, config persistence, interface detection)
- health.sh (containerd, API server, node readiness checks)
- Emergency shell for boot failure debugging

Testing:
- QEMU boot test with serial log marker detection
- K8s readiness test with kubectl verification
- Persistence test (reboot + verify state survives)
- Workload deployment test (nginx pod)
- Local storage test (PVC + local-path provisioner)
- Network policy test
- Reusable run-vm.sh launcher

Developer tools:
- dev-vm.sh (interactive QEMU with port forwarding)
- rebuild-initramfs.sh (fast iteration)
- inject-ssh.sh (dropbear SSH for debugging)
- extract-kernel-config.sh + kernel-audit.sh

Documentation:
- Full design document with architecture research
- Boot flow documentation covering all 10 init stages
- Cloud-init examples (DHCP, static IP, Portainer Edge, air-gapped)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/rootfs/etc/kubesolo/defaults.yaml

@@ -0,0 +1,22 @@
+# KubeSolo OS — Default KubeSolo Configuration
+# These defaults are used when no cloud-init or persistent config is found.
+# Overridden by: /etc/kubesolo/config.yaml (persistent) or cloud-init
+
+# Data directory for K8s state (certs, etcd/sqlite, manifests)
+data-dir: /var/lib/kubesolo
+
+# Enable local-path provisioner for PersistentVolumeClaims
+local-storage: true
+
+# API server will listen on all interfaces
+bind-address: 0.0.0.0
+
+# Cluster CIDR ranges
+cluster-cidr: 10.42.0.0/16
+service-cidr: 10.43.0.0/16
+
+# Disable components not needed for single-node
+# (KubeSolo may handle this internally)
+# disable:
+#   - traefik
+#   - servicelb

build/rootfs/etc/sysctl.d/k8s.conf

@@ -0,0 +1,17 @@
+# Kubernetes networking requirements
+net.bridge.bridge-nf-call-iptables = 1
+net.bridge.bridge-nf-call-ip6tables = 1
+net.ipv4.ip_forward = 1
+
+# inotify limits (containerd + kubelet watch requirements)
+fs.inotify.max_user_instances = 1024
+fs.inotify.max_user_watches = 524288
+
+# Connection tracking (kube-proxy)
+net.netfilter.nf_conntrack_max = 131072
+
+# File descriptor limits
+fs.file-max = 1048576
+
+# Disable swap (K8s requirement — though we have no swap anyway)
+vm.swappiness = 0