feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/Dockerfile.builder

@@ -31,6 +31,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     syslinux \
     syslinux-common \
     syslinux-utils \
+    apparmor \
+    apparmor-utils \
+    gcc-aarch64-linux-gnu \
+    binutils-aarch64-linux-gnu \
+    git \
     wget \
     xorriso \
     xz-utils \