feat(infra): Latitude bare-metal host provisioning and isolation

Provisioning chain (render-user-data → provision → cloud-init → bootstrap →
net-setup), from-scratch minisign verifier, signed offline package closure, the
egress hard-deny firewall floor, bridge L2 hardening, WireGuard config validation,
and verify-isolation.sh adversarial checks. Local and managed systemd units.