feat: pre-bundle control-plane images for air-gap first boot (ADR-16)

[wrkode]

What

Pre-bundle the kubeadm control-plane images into the OS image and import them into
containerd at boot, so a provider-kubernetes node converges on first boot with
no registry access (air-gap). Implements ADR-16; resolves the cold-init image
strategy and de-risks the never-hang budget (kubeadm init no longer pulls).

Closes kairos-io/kairos#4205. Addresses kairos-io/kairos#4204 (never-hang budget).

How

• Build (Dockerfile): a new image-bundler stage installs a
  checksum-verified static crane, resolves the control-plane image set from the
  bundled kubeadm config images list (the same invocation as the pause pin, so
  the two can never drift), and crane pulls each ref to a ctr-importable tarball
  under /opt/provider-kubernetes/images/. Static ctr is added to the containerd
  build so the import works on the musl Hadron base. Build-time assertion: >=5
  tarballs and the pause image present.
• Import (internal/imageimport + import-images subcommand): imports every
  *.tar into containerd's k8s.io namespace via argv ctr (no shell), bounded
  by context, idempotent, a no-op when nothing is bundled, attempts every tarball
  and reports the first error.
• Ordering (internal/provider): the import is emitted as a yip step ordered
  before the reconcile step in the same network.after stage, so images are in
  containerd before kubeadm init/join runs. A systemd oneshot alone races the
  kairos-agent reconcile stage. A systemd/provider-kubernetes-image-import.service
  oneshot is kept (ordered before kubelet) for the kubelet/reboot path.
• Budget (internal/reconcile/budget_test.go): regression test locking the
  #4204 never-hang invariant — Total is the binding ceiling, below
  PerAttempt*MaxAttempts.

Validation

go build / go test ./... / vet / golangci-lint all green (imageimport 95%
coverage).

End-to-end on an isolated (no-NAT) libvirt network on the Hadron v0.4.0 musl
base:

• Air-gap confirmed: numeric egress to 1.1.1.1 fails (registry unreachable).
• Node reaches phase=Converged / outcome=success; v1.34.0,
  containerd://2.1.4, Hadron Linux, kernel 7.1.0-hadron.
• All 5 control-plane static pods + kube-proxy + etcd Running; all 7
  provider-kubernetes.kairos.io/* annotations present.
• Zero containerd image-pull events — every image came from the local import.
• Reboot-persistence: images present and node re-converges after reboot.

The first air-gap boot caught a real ordering bug (the systemd oneshot raced the
reconcile yip stage; kubeadm init ran with 1/7 images) — fixed by the yip in-stage
ordering above and re-validated.

Notes / follow-ups (not in this PR)

• P5 (deferred, security-gated): digest-pin the build-time crane pull
  (content-addressed, reproducible) — needs security-architect review.
• Consider defaulting localAPIEndpoint.advertiseAddress to control_plane_host
  for routeless air-gap nodes (kubeadm rejects a 0.0.0.0 bind with no default
  route).
• CNI is intentionally not bundled (operator's choice).

[wrkode]

LGTM