feat(installer): add Home Server as an explicit opt-in profile

[castrojo]

Summary

Final replacement for #463, stacked on #485 (and #484).

• Preserve minimal Bluefin Server as profile zero/default; Home Server is an explicit opt-in, not a default-on container runtime. Existing Homelab control-plane/node entries remain.
• Keep installation native systemd-sysinstall/repart. Add private owner/engine choices, cancellation/validation before erasure and first-boot nonroot owner setup with root locked and SSH key-only.
• Seed paired Homebrew machine/integration assets and selected runtime sysexts offline from the signed installer. Share the extension payload without drifting the existing Homelab flow.
• Retain ordinary SSH Brew/tool use, detached tmux, host engine workloads, same-path project mounts, exit/signal/descriptor semantics and persistent package state.

Verification

• Local just validate, Python lint/type checks, 219 Bats cases and pre-commit run --all-files passed. The initial full pytest run exposed a real documentation-link error; correcting it passed all 49 documentation cases. Current-head GitHub unit, Go, docs, validate, actionlint and zizmor checks are now successful. No test expectation was weakened.
• Actual integrated x86_64 signed image build/export and ELF/program closure passed. Final head 6dbf21137e89c3bf7c430d5fc890448991257ed9 was rebuilt/exported cleanly after removing generated Python bytecode from its local source directory. All 30 non-SBOM payloads match the boot-tested release byte-for-byte; only the SBOM digest changed. The real publication verifier accepted 31 final signed release assets with the local development signer.
• Complete QEMU/Fedora-OVMF Secure Boot console acceptance passed: disk chosen by number, explicit confirmation, unrelated decoy disk untouched, native offline sysinstall, installed dm-verity boot, locked root, nonroot owner tty1 login and a second installed boot with the installer still attached.
• Both installed boots passed real SSH Brew installs/update, installed-tool persistence, detached tmux, rootless host Podman workloads via Brew Docker/Podman clients, Compose, exit status and same-path bind mounts. This run does not claim to boot the optional Docker daemon backend.
• Original helper/policy: three expected boundary failures reproduced. Corrected installed helper: 29 real-machine behavior cases passed without skips, including active GID/groups, cwd identity/access, sudo audit/argv privacy, descriptors, signals, nonowner restrictions and lingering scopes.

Merge prerequisites

Merge #484 first, then #485 after fsdk-containers#436 receives independent approval/merge and #485 is re-pinned to its actual main SHA. This draft does not make Home Server the default and does not bypass upstream-static Docker policy or sudo/namespace review.

full-build is applied: actual CI build/boot lane is running. Local acceptance is complete; remote full-build/boot success is not yet claimed.

[github-actions]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: castrojo

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS [castrojo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment