feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/config/modules-arm64.list

@@ -0,0 +1,81 @@
+# Kernel modules loaded at boot by init (ARM64 / Raspberry Pi)
+# One module per line. Lines starting with # are ignored.
+# Modules are loaded in order listed — dependencies must come first.
+
+# Network device drivers (loaded early so interfaces are available)
+# Note: no e1000/e1000e on ARM64 — those are x86 Intel NIC drivers
+virtio_net
+
+# Virtio support (for QEMU VMs — block, entropy)
+virtio_blk
+virtio_rng
+
+# Raspberry Pi specific (USB Ethernet on Pi 4 is built-in, no module needed)
+# Pi 5 uses PCIe ethernet, also typically built-in
+
+# Filesystem — overlay (required for containerd)
+overlay
+
+# Netfilter dependencies (must load before conntrack)
+nf_defrag_ipv4
+nf_defrag_ipv6
+
+# Netfilter / connection tracking (required for kube-proxy)
+nf_conntrack
+nf_nat
+nf_conntrack_netlink
+
+# nftables (modern iptables backend)
+nf_tables
+nft_compat
+nft_chain_nat
+nft_ct
+nft_masq
+nft_nat
+nft_redir
+
+# Netfilter xt match/target modules (used by kube-proxy iptables rules via nft_compat)
+xt_conntrack
+xt_MASQUERADE
+xt_mark
+xt_comment
+xt_multiport
+xt_nat
+xt_addrtype
+xt_connmark
+xt_REDIRECT
+xt_recent
+xt_statistic
+xt_set
+
+# nft extras (reject, fib — used by kube-proxy nf_tables rules)
+nft_reject
+nft_reject_ipv4
+nft_reject_ipv6
+nft_fib
+nft_fib_ipv4
+nft_fib_ipv6
+
+# Reject targets (used by kube-proxy iptables-restore rules)
+nf_reject_ipv4
+nf_reject_ipv6
+ipt_REJECT
+ip6t_REJECT
+
+# nfacct extension (kube-proxy probes for it)
+xt_nfacct
+
+# Networking — bridge and netfilter (required for K8s pod networking)
+# Load order: llc → stp → bridge → br_netfilter
+llc
+stp
+bridge
+br_netfilter
+veth
+vxlan
+
+# IPVS — useful for kube-proxy IPVS mode and CNI plugins
+ip_vs
+ip_vs_rr
+ip_vs_wrr
+ip_vs_sh