feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -1,9 +1,10 @@
 .PHONY: all fetch kernel build-cloudinit build-update-agent build-cross rootfs initramfs \
-       iso disk-image oci-image \
-       test-boot test-k8s test-persistence test-deploy test-storage test-all \
-       test-cloudinit test-update-agent \
+       iso disk-image oci-image rpi-image \
+       kernel-arm64 rootfs-arm64 \
+       test-boot test-k8s test-persistence test-deploy test-storage test-security test-all \
+       test-boot-arm64 test-cloudinit test-update-agent \
        bench-boot bench-resources \
-       dev-vm dev-vm-shell quick docker-build shellcheck \
+       dev-vm dev-vm-shell dev-vm-arm64 quick docker-build shellcheck \
        kernel-audit clean distclean help
 
 SHELL := /bin/bash
@@ -71,6 +72,24 @@ build-cross:
 	@echo "==> Cross-compiling for amd64 + arm64..."
 	$(BUILD_DIR)/scripts/build-cross.sh
 
+# =============================================================================
+# ARM64 Raspberry Pi targets
+# =============================================================================
+kernel-arm64:
+	@echo "==> Building ARM64 kernel for Raspberry Pi..."
+	$(BUILD_DIR)/scripts/build-kernel-arm64.sh
+
+rootfs-arm64:
+	@echo "==> Preparing ARM64 rootfs..."
+	TARGET_ARCH=arm64 $(BUILD_DIR)/scripts/fetch-components.sh
+	TARGET_ARCH=arm64 $(BUILD_DIR)/scripts/extract-core.sh
+	TARGET_ARCH=arm64 $(BUILD_DIR)/scripts/inject-kubesolo.sh
+
+rpi-image: rootfs-arm64 kernel-arm64
+	@echo "==> Creating Raspberry Pi SD card image..."
+	$(BUILD_DIR)/scripts/create-rpi-image.sh
+	@echo "==> Built: $(OUTPUT_DIR)/$(OS_NAME)-$(VERSION).rpi.img"
+
 # =============================================================================
 # Kernel validation
 # =============================================================================
@@ -101,6 +120,14 @@ test-storage: iso
 	@echo "==> Testing local storage provisioning..."
 	test/integration/test-local-storage.sh $(OUTPUT_DIR)/$(OS_NAME)-$(VERSION).iso
 
+test-security: iso
+	@echo "==> Testing security hardening..."
+	test/integration/test-security-hardening.sh $(OUTPUT_DIR)/$(OS_NAME)-$(VERSION).iso
+
+test-boot-arm64:
+	@echo "==> Testing ARM64 boot in QEMU..."
+	test/qemu/test-boot-arm64.sh
+
 test-all: test-boot test-k8s test-persistence
 
 # Cloud-init Go tests
@@ -163,6 +190,10 @@ dev-vm-debug: iso
 	@echo "==> Launching dev VM (debug mode)..."
 	hack/dev-vm.sh $(OUTPUT_DIR)/$(OS_NAME)-$(VERSION).iso --debug
 
+dev-vm-arm64:
+	@echo "==> Launching ARM64 dev VM..."
+	hack/dev-vm-arm64.sh
+
 # Fast rebuild: only repack initramfs + ISO (skip fetch/extract)
 quick:
 	@echo "==> Quick rebuild (repack + ISO only)..."
@@ -199,7 +230,7 @@ distclean: clean
 help:
 	@echo "KubeSolo OS Build System (v$(VERSION))"
 	@echo ""
-	@echo "Build targets:"
+	@echo "Build targets (x86_64):"
 	@echo "  make fetch              Download Tiny Core ISO, KubeSolo, dependencies"
 	@echo "  make kernel             Build custom kernel with CONFIG_CGROUP_BPF=y"
 	@echo "  make build-cloudinit    Build cloud-init Go binary"
@@ -213,25 +244,33 @@ help:
 	@echo "  make quick              Fast rebuild (re-inject + repack + ISO only)"
 	@echo "  make docker-build       Reproducible build inside Docker"
 	@echo ""
+	@echo "Build targets (ARM64 Raspberry Pi):"
+	@echo "  make kernel-arm64       Build ARM64 kernel from raspberrypi/linux"
+	@echo "  make rootfs-arm64       Extract + prepare ARM64 rootfs from piCore64"
+	@echo "  make rpi-image          Create Raspberry Pi SD card image with A/B partitions"
+	@echo ""
 	@echo "Test targets:"
 	@echo "  make test-boot          Boot ISO in QEMU, verify boot success"
 	@echo "  make test-k8s           Boot + verify K8s node reaches Ready"
 	@echo "  make test-persist       Reboot disk image, verify state persists"
 	@echo "  make test-deploy        Deploy nginx pod, verify Running"
 	@echo "  make test-storage       Test PVC with local-path provisioner"
+	@echo "  make test-security      Verify security hardening (AppArmor, sysctl, mounts)"
 	@echo "  make test-cloudinit     Run cloud-init Go unit tests"
 	@echo "  make test-update-agent  Run update agent Go unit tests"
 	@echo "  make test-update        A/B update cycle integration test"
 	@echo "  make test-rollback      Forced rollback integration test"
+	@echo "  make test-boot-arm64    ARM64 boot test in QEMU aarch64"
 	@echo "  make test-all           Run core tests (boot + k8s + persistence)"
 	@echo "  make test-integ         Run full integration suite"
 	@echo "  make bench-boot         Benchmark boot performance (3 runs)"
 	@echo "  make bench-resources    Benchmark resource usage (requires running VM)"
 	@echo ""
 	@echo "Dev targets:"
-	@echo "  make dev-vm         Launch interactive QEMU VM"
+	@echo "  make dev-vm         Launch interactive QEMU VM (x86_64)"
 	@echo "  make dev-vm-shell   Launch QEMU VM -> emergency shell"
 	@echo "  make dev-vm-debug   Launch QEMU VM with debug logging"
+	@echo "  make dev-vm-arm64   Launch ARM64 QEMU VM"
 	@echo "  make kernel-audit   Check kernel config against requirements"
 	@echo "  make shellcheck     Lint all shell scripts"
 	@echo ""