feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/rootfs/etc/apparmor.d/kubelet

@@ -0,0 +1,56 @@
+# AppArmor profile for kubesolo (kubelet + control plane)
+# Start in complain mode to log without blocking
+
+#include <tunables/global>
+
+profile kubesolo /usr/bin/kubesolo flags=(complain) {
+  #include <abstractions/base>
+
+  # Binary and shared libraries
+  /usr/bin/kubesolo                     mr,
+  /usr/lib/**                           mr,
+  /lib/**                               mr,
+
+  # KubeSolo state (etcd/SQLite, certificates, manifests)
+  /var/lib/kubesolo/**                  rw,
+
+  # KubeSolo configuration
+  /etc/kubesolo/**                      r,
+
+  # Containerd socket
+  /run/containerd/**                    rw,
+
+  # CNI networking
+  /etc/cni/**                           r,
+  /opt/cni/bin/**                       ix,
+
+  # Proc and sys access
+  @{PROC}/**                            r,
+  /sys/**                               r,
+
+  # Device access
+  /dev/**                               rw,
+
+  # Network access (API server, kubelet, etcd)
+  network,
+
+  # Control plane needs broad capabilities
+  capability,
+
+  # Kubectl and other tools
+  /usr/bin/kubectl                      ix,
+  /usr/local/bin/**                     ix,
+
+  # Temp files
+  /tmp/**                               rw,
+
+  # Log files
+  /var/log/**                           rw,
+
+  # Kubelet needs to manage pods
+  /var/lib/kubelet/**                   rw,
+
+  # Signal handling
+  signal,
+  ptrace,
+}