feat(build): a bare-metal platform image #281

Summary

Build and ship a CryptOS image for bare-metal servers. Today there is one kernel platform profile (build/kernel/profiles/vmware.config), and CI builds only PLATFORM=vmware. The bare-metal installer (#46) and Secure Boot key enrolment (#47) already exist, but no image can drive physical hardware.

Acceptance criteria

• A baremetal platform profile (build/kernel/profiles/baremetal.config) with drivers for common server hardware: NICs (Intel and Broadcom families), storage (NVMe, AHCI/SATA, common RAID and HBA controllers in pass-through), a hardware TPM 2.0 (TIS and CRB), a serial console, and UEFI with Secure Boot.
• task iso and the unsigned release build accept PLATFORM=baremetal, and CI builds it next to vmware, following the hub minute-saving pattern.
• It installs and boots on at least one real server, with the TPM seal, Secure Boot, the ceremony, issuance and a reboot all working. Validation evidence is recorded in the plan repo.
• The docs gain a bare-metal install page with the hardware requirements (only what's true once it works).

Tasks

• Choose the target hardware to validate on, and list its NIC, storage and TPM chips.
• Write the kernel profile. Keep it minimal: only the drivers needed, since every module is attack surface.
• Add the platform to the build and CI matrix.
• Install and validate on real hardware (Linux box lab).
• Docs.

Notes

Found during the docs review: the hardware-requirements table can only describe QEMU and ESXi today.