NanoPi-NEO3 disaster recovery boots from a prebaked image built in this repo

## Summary

Build the NanoPi-NEO3's recovery image in this repo so a
disaster-recovery reflash starts from a card that already carries the
box's configuration. Recovery becomes a card swap plus one break-glass
SSH session, instead of a hand-merged `/etc`.

## Motivation

Recovery today is: flash a stock base image, restore package selections
and `/home`, then hand-merge `/etc` over SSH. The merge is the fragile,
remote-only part — a wrong `fstab` UUID locks out a box that lives on
another continent, reachable only through people on-site who can't do
more than swap a card and power it on. Baking the configuration into
the image removes the merge and most of the risk. Surfaced while
drafting the DR write-up: alunduil/blog.alunduil.com#209.

## Scope

The mechanism is settled by ADR 0002: Armbian's build framework,
`userpatches/` committed here, the image published as a public GitHub
Release.

- Commit `userpatches/` — a board config, a `customize-image.sh`, and
the overlay it copies from.
- Add the build workflow driving `armbian/build`, pinned by ref,
publishing the image as a release.
- Bake what carries no secret: the operator's public key in root's
`authorized_keys`, password authentication off, the first-login flag
cleared so it can't gate SSH, the hostname, DHCP, and Tailscale,
Grafana Alloy and unattended upgrades installed and enabled.
- Write the idempotent configuration script in `scripts/`, run from
`customize-image.sh` at build time and over SSH afterwards, taking
the Tailscale and Alloy credentials as inputs.
- Keep boot-critical state image-owned (`fstab`/root handling) so a
reflash needs no manual `/etc` merge.

## Acceptance criteria

- [ ] An image build lives in this repo and publishes a bootable
NanoPi-NEO3 image as a release.
- [ ] The published image carries no secret material.
- [ ] A card flashed from it boots, takes a DHCP lease, and accepts SSH
on the baked-in key.
- [ ] Running the configuration script over that session brings the box
up as an approved exit node.

## Additional context

- ADR 0002 records the decision, the requirements it was judged
against, and the options rejected — including NixOS, rejected on
budget rather than merit.
- The Tailscale identity question is #262. ADR 0002 settles its
direction: the identity doesn't travel on the card.
- The on-site flashing kit and procedure moved to #522; the
pre-positioned spare card is #523.
- Grafana Alloy shipping telemetry again is #473, independent of this
issue — the image installs Alloy without inheriting its broken state.
- Surfaced by alunduil/blog.alunduil.com#209 (the DR post) and its
"better version waiting to be built" closing.