feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

update/cmd/opts.go

@@ -1,11 +1,27 @@
 package cmd
 
+import (
+	"github.com/portainer/kubesolo-os/update/pkg/bootenv"
+)
+
 // opts holds shared command-line options for all subcommands.
 type opts struct {
 	ServerURL   string
 	GrubenvPath string
 	TimeoutSecs int
 	PubKeyPath  string
+	BootEnvType string // "grub" or "rpi"
+	BootEnvPath string // path for RPi boot control dir
+}
+
+// NewBootEnv creates a BootEnv from the parsed options.
+func (o opts) NewBootEnv() bootenv.BootEnv {
+	switch o.BootEnvType {
+	case "rpi":
+		return bootenv.NewRPi(o.BootEnvPath)
+	default:
+		return bootenv.NewGRUB(o.GrubenvPath)
+	}
 }
 
 // parseOpts extracts command-line flags from args.
@@ -14,6 +30,7 @@ func parseOpts(args []string) opts {
 	o := opts{
 		GrubenvPath: "/boot/grub/grubenv",
 		TimeoutSecs: 120,
+		BootEnvType: "grub",
 	}
 
 	for i := 0; i < len(args); i++ {
@@ -46,6 +63,16 @@ func parseOpts(args []string) opts {
 				o.PubKeyPath = args[i+1]
 				i++
 			}
+		case "--bootenv":
+			if i+1 < len(args) {
+				o.BootEnvType = args[i+1]
+				i++
+			}
+		case "--bootenv-path":
+			if i+1 < len(args) {
+				o.BootEnvPath = args[i+1]
+				i++
+			}
 		}
 	}