Stateless (Warewulf-style) provisioning: profiles, node pools, overlays, dnsmasq export, compute image

Profiles bind a RAM-booted root image to overlay templates; assigning a
machine allocates a node name and management IP, writes the per-MAC PXE
entry with a per-node token and exports static leases for dnsmasq. Nodes
pull rendered overlays (hosts, slurm.conf from inventory, gres.conf, SSH
host key, munge key) through rollcall-overlay.service; the runtime refresh
timer is the heartbeat. Adds the compute-debian13 image definition and a
generic live-build root image script, CLI and web UI for profiles/assign.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/config.example.json

@@ -8,6 +8,19 @@
   "agent_token": "<AGENT-TOKEN: rollcall keygen>",
   "commission_append": "boot=live components fetch=http://10.213.77.1/rollcall/filesystem.squashfs rollcall.server=http://10.213.77.1 rollcall.token=<AGENT-TOKEN> console=tty0 console=ttyS0,115200n8",
   "ipmitool": "ipmitool",
+  "server_url": "http://10.213.77.1",
+  "images_dir": "/srv/rollcall/images",
+  "overlays_dir": "/etc/rollcall/overlays",
+  "dnsmasq_dir": "/var/lib/rollcall/dnsmasq",
+  "node_pools": {"mgmt": "10.213.77.50-10.213.77.99"},
+  "cluster_vars": {
+    "domain": "pxe.local",
+    "cluster_name": "rollcall-lab",
+    "slurm_controller": "pxe-server",
+    "slurm_controller_ip": "10.213.77.1",
+    "partition": "compute",
+    "ssh_keys": ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSAJ4owXlJreHP3sa4HstasxA5pk1ZAPi6vnzOpA5R1 ilker@t440s"]
+  },
   "bmc_hints": [
     {"mac": "bc:24:11:8e:1e:6c", "address": "10.213.77.11", "port": 623, "user": "admin", "password": "password", "comment": "pxe-node01 (VM 211, pve-vbmc)"},
     {"mac": "bc:24:11:36:90:3f", "address": "10.213.77.12", "port": 623, "user": "admin", "password": "password", "comment": "pxe-node02 (VM 212, pve-vbmc)"}