add reproducible DragonOS ARM64 image builder

[AndrewMohawk]

What changed

• add a destructive-action-guarded ARM64 image builder that converts the official Beta42 userspace onto a generic Debian 13 ARM64 UEFI target
• accept either a source block disk or the official Beta42 .img.gz, verifying its exact byte size and SHA-256 before read-only loop attachment
• pin Debian package selection to the 20260802T090000Z Debian snapshots during construction, then restore live repositories in the finished image
• provide explicit full and --redistributable profiles
• remove known non-redistributable RealVNC, Widevine, SDRplay API, BaseStation, and SDR4space payloads from the public profile
• rebuild SigDigger for ARM64 from exact pinned Sigutils, Suscan, SuWidgets, and SigDigger commits
• retain pinned source trees for the rebuilt SigDigger stack and exact SDRTrunk nightly revision inside the image
• record package conversion, source payloads, exclusions, installed packages, build provenance, and source-license evidence
• install portable ARM64 UEFI GRUB configuration, generic initramfs storage drivers, and page-size-portable swap recreation
• restore the normal DragonOS desktop convention: dragon / dragon, direct XFCE autologin, and no console-only account wizard
• remove imported Pi-only LightDM and rpd-labwc session state so the generic image starts XFCE
• verify the SDR application set, GNU Radio execution, desktop session, exclusions, linkage, pinned revisions, and source-audit clearance

Why

The earlier private disk depended on a retained source disk and did not capture enough provenance for a public distribution. This builder is self-contained after users obtain the official upstream archive, freezes Debian package selection for repeatability, replaces an unidentified ARM64 binary with a pinned source build, and makes the remaining binary-release boundary explicit and machine-auditable.

Validation

• complete --redistributable 40 GB ARM64 disk build exited 0
• source audit: 35 retained payloads, 2 exclusions, 1 source rebuild, 0 unresolved records
• read-only FAT and ext4 filesystem checks passed after the final desktop correction
• image booted under ARM64 UEFI from NVMe using filesystem UUID and 6.12.100+deb13-arm64
• system reached running; NetworkManager, SSH, and LightDM were active
• XFCE and xfwm4 launched through direct dragon autologin and the rendered desktop was captured
• official default dragon / dragon credentials work over SSH
• GNU Radio 3.10.12.0, Companion startup, and a finite scheduler flowgraph passed
• full live dragonos-verify as the normal user: 104 passed, 0 failed
• zstd frame test passed; complete decompression reproduced raw SHA-256 72eb88691ccad3d8d22fe103fed5bb42fdad17701b262bd82dd1f82e35865972
• Bash syntax, ShellCheck, and Git whitespace validation passed

Remaining gates

• Physical HackRF receive validation on this final corrected image remains pending. USB routing remains ask so the Mac and VM can share the device intentionally.
• Known proprietary payloads are excluded, but aggregate DragonOS Pi64 image and branding redistribution permission remains a separate gate before publishing the derived binary.

This PR contains only original builder and overlay code plus text manifests. It does not include the DragonOS/Beta42 disk image or third-party binaries.