feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/scripts/fetch-components.sh

@@ -10,9 +10,56 @@ CACHE_DIR="${CACHE_DIR:-$PROJECT_ROOT/build/cache}"
 # shellcheck source=../config/versions.env
 . "$SCRIPT_DIR/../config/versions.env"
 
+# Verify SHA256 checksum of a downloaded file
+verify_checksum() {
+    local file="$1" expected="$2" name="$3"
+    # Skip if no expected checksum provided
+    [ -z "$expected" ] && return 0
+    local actual
+    actual=$(sha256sum "$file" | awk '{print $1}')
+    if [ "$actual" = "$expected" ]; then
+        echo "    Checksum OK: $name"
+        return 0
+    else
+        echo "ERROR: Checksum mismatch for $name"
+        echo "  Expected: $expected"
+        echo "  Got:      $actual"
+        rm -f "$file"
+        return 1
+    fi
+}
+
 mkdir -p "$CACHE_DIR"
 
-# --- Tiny Core Linux ISO ---
+# Detect target architecture
+FETCH_ARCH="${TARGET_ARCH:-amd64}"
+
+# --- ARM64: piCore64 image instead of x86_64 ISO ---
+if [ "$FETCH_ARCH" = "arm64" ]; then
+    PICORE_IMG="$CACHE_DIR/$PICORE_IMAGE"
+    if [ -f "$PICORE_IMG" ]; then
+        echo "==> piCore64 image already cached: $PICORE_IMG"
+    else
+        echo "==> Downloading piCore64 ${PICORE_VERSION} (${PICORE_ARCH})..."
+        echo "    URL: $PICORE_IMAGE_URL"
+        wget -q --show-progress -O "$PICORE_IMG" "$PICORE_IMAGE_URL" 2>/dev/null || \
+            curl -fSL "$PICORE_IMAGE_URL" -o "$PICORE_IMG"
+        echo "==> Downloaded: $PICORE_IMG ($(du -h "$PICORE_IMG" | cut -f1))"
+    fi
+
+    # Also fetch RPi firmware
+    echo "==> Fetching RPi firmware..."
+    "$SCRIPT_DIR/fetch-rpi-firmware.sh"
+
+    # Skip x86_64 ISO and TCZ downloads for ARM64
+    echo ""
+    echo "==> ARM64 fetch complete."
+    echo "==> Component cache:"
+    ls -lh "$CACHE_DIR"/ 2>/dev/null || true
+    exit 0
+fi
+
+# --- x86_64: Tiny Core Linux ISO ---
 TC_ISO="$CACHE_DIR/$TINYCORE_ISO"
 TC_URL="${TINYCORE_MIRROR}/${TINYCORE_VERSION%%.*}.x/${TINYCORE_ARCH}/release/${TINYCORE_ISO}"
 
@@ -28,6 +75,7 @@ else
         wget -q --show-progress -O "$TC_ISO" "$TC_URL_ALT"
     }
     echo "==> Downloaded: $TC_ISO ($(du -h "$TC_ISO" | cut -f1))"
+    verify_checksum "$TC_ISO" "$TINYCORE_ISO_SHA256" "Tiny Core ISO"
 fi
 
 # --- KubeSolo ---
@@ -88,6 +136,7 @@ else
     rm -rf "$TEMP_DIR"
 
     echo "==> KubeSolo binary: $KUBESOLO_BIN ($(du -h "$KUBESOLO_BIN" | cut -f1))"
+    verify_checksum "$KUBESOLO_BIN" "$KUBESOLO_SHA256" "KubeSolo binary"
 fi
 
 # --- Tiny Core kernel module extensions (netfilter, iptables) ---
@@ -114,6 +163,7 @@ else
     if wget -q --show-progress -O "$NETFILTER_TCZ" "$NETFILTER_TCZ_URL" 2>/dev/null || \
        curl -fSL "$NETFILTER_TCZ_URL" -o "$NETFILTER_TCZ" 2>/dev/null; then
         echo "==> Downloaded: $NETFILTER_TCZ ($(du -h "$NETFILTER_TCZ" | cut -f1))"
+        verify_checksum "$NETFILTER_TCZ" "$NETFILTER_TCZ_SHA256" "netfilter TCZ"
     else
         echo "WARN: Failed to download netfilter modules. kube-proxy may not work."
         rm -f "$NETFILTER_TCZ"
@@ -131,6 +181,7 @@ else
     if wget -q --show-progress -O "$NET_BRIDGING_TCZ" "$NET_BRIDGING_TCZ_URL" 2>/dev/null || \
        curl -fSL "$NET_BRIDGING_TCZ_URL" -o "$NET_BRIDGING_TCZ" 2>/dev/null; then
         echo "==> Downloaded: $NET_BRIDGING_TCZ ($(du -h "$NET_BRIDGING_TCZ" | cut -f1))"
+        verify_checksum "$NET_BRIDGING_TCZ" "$NET_BRIDGING_TCZ_SHA256" "net-bridging TCZ"
     else
         echo "WARN: Failed to download net-bridging modules. CNI bridge may not work."
         rm -f "$NET_BRIDGING_TCZ"
@@ -148,6 +199,7 @@ else
     if wget -q --show-progress -O "$IPTABLES_TCZ" "$IPTABLES_TCZ_URL" 2>/dev/null || \
        curl -fSL "$IPTABLES_TCZ_URL" -o "$IPTABLES_TCZ" 2>/dev/null; then
         echo "==> Downloaded: $IPTABLES_TCZ ($(du -h "$IPTABLES_TCZ" | cut -f1))"
+        verify_checksum "$IPTABLES_TCZ" "$IPTABLES_TCZ_SHA256" "iptables TCZ"
     else
         echo "WARN: Failed to download iptables. KubeSolo bundles its own but this is a fallback."
         rm -f "$IPTABLES_TCZ"