Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

live-image/mkosi.conf

@@ -0,0 +1,38 @@
+# Vetting live image (Phase 2 skeleton).
+#
+# Produces a Debian-based rootfs packaged as squashfs plus a kernel
+# image, ready to be served over HTTP to iPXE. The image is deliberately
+# small: only what the agent needs to run Phase 2 (the Hello / Claim /
+# Heartbeat loop). Phase 4+ adds smartctl, stress-ng, fio, iperf3, etc.
+
+[Distribution]
+Distribution=debian
+Release=bookworm
+Repositories=main
+
+[Output]
+Format=directory
+Output=build
+
+[Content]
+Bootable=yes
+BuildPackages=
+Packages=
+    systemd
+    systemd-sysv
+    udev
+    linux-image-amd64
+    live-boot
+    iproute2
+    iputils-ping
+    openssh-server
+    ca-certificates
+    curl
+    dmidecode
+    pciutils
+    usbutils
+
+# Phase 4 will add: smartmontools stress-ng fio iperf3 lshw lm-sensors
+
+[Host]
+# Copy the prebuilt Go agent in from the repo root via postinst.