feat: add security hardening, AppArmor, and ARM64 Raspberry Pi support (Phase 6)

Security hardening: bind kubeconfig server to localhost, mount hardening
(noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module
loading lock after boot, SHA256 checksum verification for downloads,
kernel AppArmor + Audit support, complain-mode AppArmor profiles for
containerd and kubelet, and security integration test.

ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build
from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4-
partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting
GRUB vs RPi boot environments, architecture-aware build scripts, QEMU
aarch64 dev VM and boot test.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

update/cmd/status.go

@@ -2,42 +2,50 @@ package cmd
 
 import (
 	"fmt"
-
-	"github.com/portainer/kubesolo-os/update/pkg/grubenv"
 )
 
 // Status displays the current A/B slot configuration and boot state.
 func Status(args []string) error {
 	opts := parseOpts(args)
-	env := grubenv.New(opts.GrubenvPath)
+	env := opts.NewBootEnv()
 
-	vars, err := env.ReadAll()
+	activeSlot, err := env.ActiveSlot()
 	if err != nil {
-		return fmt.Errorf("reading GRUB environment: %w", err)
+		return fmt.Errorf("reading active slot: %w", err)
 	}
 
-	activeSlot := vars["active_slot"]
-	bootCounter := vars["boot_counter"]
-	bootSuccess := vars["boot_success"]
+	passiveSlot, err := env.PassiveSlot()
+	if err != nil {
+		return fmt.Errorf("reading passive slot: %w", err)
+	}
 
-	passiveSlot := "B"
-	if activeSlot == "B" {
-		passiveSlot = "A"
+	bootCounter, err := env.BootCounter()
+	if err != nil {
+		return fmt.Errorf("reading boot counter: %w", err)
+	}
+
+	bootSuccess, err := env.BootSuccess()
+	if err != nil {
+		return fmt.Errorf("reading boot success: %w", err)
 	}
 
 	fmt.Println("KubeSolo OS — A/B Partition Status")
 	fmt.Println("───────────────────────────────────")
 	fmt.Printf("  Active slot:   %s\n", activeSlot)
 	fmt.Printf("  Passive slot:  %s\n", passiveSlot)
-	fmt.Printf("  Boot counter:  %s\n", bootCounter)
-	fmt.Printf("  Boot success:  %s\n", bootSuccess)
+	fmt.Printf("  Boot counter:  %d\n", bootCounter)
+	if bootSuccess {
+		fmt.Printf("  Boot success:  1\n")
+	} else {
+		fmt.Printf("  Boot success:  0\n")
+	}
 
-	if bootSuccess == "1" {
+	if bootSuccess {
 		fmt.Println("\n  ✓ System is healthy (boot confirmed)")
-	} else if bootCounter == "0" {
+	} else if bootCounter == 0 {
 		fmt.Println("\n  ✗ Boot counter exhausted — rollback will occur on next reboot")
 	} else {
-		fmt.Printf("\n  ⚠ Boot pending verification (%s attempts remaining)\n", bootCounter)
+		fmt.Printf("\n  ⚠ Boot pending verification (%d attempts remaining)\n", bootCounter)
 	}
 
 	return nil