v0.4: package atomic prepared-node install upgrade rollback and uninstall

Parent epic: #6
Depends on #108 and #109; final behavior also depends on #110.

Package immutable amd64/arm64 CNI and node-agent artifacts and an opt-in prepared-node lifecycle:

- atomically install the chained entry and request containerd `cgroupPath`;
- preserve and validate the exact prior conflist;
- use a narrow AppArmor/seccomp/capability/RBAC profile;
- remove preview scheduling eligibility before mutation;
- coordinate upgrades without detaching the last deny;
- drain or explicitly replace preview workloads before uninstall;
- restore the byte-identical prior chain and remove only exact Waycloak-owned pins.

Prove interrupted install, partial files, incompatible CNI, node reboot, upgrade, rollback, and uninstall on amd64 Flatcar and arm64 Ubuntu/k3s. Helm remains the primary surface and the feature is disabled by default.