Enforce payload layer-size budget against real history; add bootc signing runbook

[oratis]

Layer-size budget now actually runs (os-infra review #5)

The layer-SIZE half of test-containerfile-layer-budget.sh had never run against a real image: os-e2e invoked the guard only at the pre-build Validate scripts step, before build-iso.sh produced output/andromeda-v1-history.json. It therefore always emitted ANDROMEDA_CONTAINERFILE_LAYER_SIZE_SKIP reason=no-history-json, leaving the default single-layer ceiling untested — so the real failure mode stayed uncaught: an over-consolidated payload layer overflowing the installer /var/tmp overlay during bootc install (the recent outage).

• The guard now has count / size / all modes (ANDROMEDA_LAYER_BUDGET_MODE). os-e2e runs count pre-build (static Containerfile DNF-layer floor, no image needed) and a new size step post-build against the real history, placed before the long install so it fails fast.
• size mode FAILS (does not skip) when the history JSON is missing — the guard can never silently no-op again. all (default) keeps it unit-runnable, skipping size when no image is built.
• The size check always prints ANDROMEDA_MAX_PAYLOAD_LAYER_BYTES_OBSERVED=<n> threshold=<t> on pass and fail, so the real baseline is greppable from CI logs.
• Default ceiling set to a 3 GiB headroom value (3221225472) chosen to PASS the known-good image on the first post-build run while still catching gross over-consolidation. A comment and the failure message tell maintainers to read the OBSERVED line and tighten toward OBSERVED + margin once CI reports the real max.

The real observed baseline must be read from this PR's os-e2e run and the threshold tightened in a follow-up if warranted (I cannot build the ISO locally).

bootc signing: documented, NOT activated (security review #4)

Installs point --target-imgref at the mutable, unsigned ghcr.io/oratis/andromeda:edge. A strict signing policy cannot be enabled now: no real key exists and a fail-closed policy.json would reject every registry pull and break the unsigned :edge update flow os-e2e exercises.

• os/signing/policy.json.example — strict sigstore template (default reject; cosign-verified ghcr.io/oratis/andromeda over docker; local containers-storage/oci/dir still accepted). It lives outside os/files/, so COPY os/files/ / can never install it as /etc/containers/policy.json; the image keeps the Fedora default and :edge pulls are unaffected. The effective enforced policy is unchanged.
• docs/development/installable-preview.md gains a runbook section (explicitly NOT YET ENFORCED) covering the cosign sign release step and how to activate enforcement once a key exists.
• Both kickstart --target-imgref comments now point at the template and runbook.

Validation

• shellcheck os/scripts/*.sh os/installer/*.sh os/files/usr/libexec/* — clean.
• Guard exercised locally: count-only passes; synthesized andromeda-v1-history.json under threshold passes, over threshold prints OBSERVED and exits non-zero; size mode hard-fails on missing history.
• os-e2e.yml parses (PyYAML); new size step sits after build, before install.
• ISO cannot be built in this environment; the observed baseline comes from this PR's os-e2e run.