feat: the kernel, initrd, firmware, bootloaders and installer move to plans/keel-boot

[marcos-mendez]

Decision 0052, point 1: a separate boot layer per appliance, used only by the ISO. The kernel, initrd, firmware, bootloaders and installer leave the shared layers, so the container template never carries them.

Change

• plans/turnkey/base no longer includes plans/boot and no longer lists grub-pc, tkl-installer, efivar, eject, jitterentropy-rngd, qemu-guest-agent or acpi-support-base. It now lists systemd and systemd-sysv itself, because plans/boot used to bring them.
• New plans/keel-boot holds all of them (#include <boot> plus the list above). Keel-Linux/buildtasks products/boot builds it with bt-layer --boot APP.
• GRUB's overlay and conf move to overlays/keel-boot and conf/keel-boot. grub-debug is split in two: its journald half (ForwardToWall=no) is something a container needs as well, so it moves to conf/turnkey.d/journald-no-wall.
• mk/turnkey-desktop.mk now points at the moved overlay.
• tests/plans-boot.bats resolves the plans with cpp the way fab-plan-resolve does. It fails if turnkey/base names a package that keel assemble refuses in a template. CI now installs cpp.

Why each package is VM-only

Package(s)	Reason
linux-image-*, linux-base	kernel; a container runs on the host's
initramfs-tools*, dracut-install, klibc-utils, libklibc, busybox	initrd and its early userspace; busybox is pulled in only by the live initrd
live-boot*, live-tools, isolinux, syslinux*	boot the live ISO
grub-, os-prober, efivar (+libefi)	bootloader and UEFI variables
tkl-installer, eject	install the ISO onto a disk
firmware-linux-free	device firmware is loaded by a machine's kernel
hdparm	tunes physical disks
qemu-guest-agent	talks to a QEMU host over virtio-serial; LXC has no such channel
acpi-support-base, acpid	ACPI events come from a machine's firmware
jitterentropy-rngd	feeds the kernel's entropy pool, which in a container is the host's

These stay in the container: lvm2, parted and fdisk (webmin-lvm and webmin-fdisk depend on them), kmod, udev, file, zstd and man-db.

Measured

The published core 19.0-9 and web 19.0-4 layers were assembled locally with keel assemble, and the same set of packages was then purged with dpkg. dpkg --audit came back clean and apt-get check passed.

	rootfs (apparent)	tar stream	.tar.zst
core before	903.6 MB	931.2 MB	360.3 MB
core after (40 pkgs incl. 8 orphaned libs)	714.0 MB	736.6 MB	199.8 MB
web before	992.1 MB	1019.9 MB	383.1 MB
web after (32 pkgs)	805.4 MB	828.3 MB	224.0 MB

Cheap wins I checked, none of which needs a change: the apt lists and caches are already empty, because fab cleans them and bt-layer excludes var/cache/apt. /var/log holds 13 KB. Locale and man path-excludes are already in place through localepurge, which keeps man[0-9]. There are no doc path-excludes and none were added (/usr/share/doc is 33 MB).

Merge order

1. This PR.
2. Keel-Linux/buildtasks (bt-layer --boot).
3. Rebuild the layers. keel-release does not rebuild a layer whose tarball still matches its manifest, so run it with --rebuild.
4. Keel-Linux/keel (template guard).

If keel is merged before the layers are rebuilt, it refuses the old layers.