OS deployment: image catalog with upstream sync, deploy/release jobs, agent deploy mode, UI and CLI

- rollcall os list|sync|import|promote|rm: <os_dir>/<name>/<version>/{disk.raw.zst,meta.json},
  current symlink, vendor checksum verification (GNU/BSD formats, sha256/sha512), qemu-img -> raw,
  zstd in-process, keep-N pruning, nightly rollcall-os-sync.timer, deploy/os-sources.json
  (Debian 13, Ubuntu 24.04, Rocky 9, AlmaLinux 9, CentOS Stream 9)
- jobs table + API: deploy (disk pick, hostname/IP allocation, job token, per-MAC deploy PXE
  entry), release (wipe), progress, cancel, cloud-init phone_home
- agent/rollcall-deploy.py: streamed write with sha256 + pv progress, NoCloud seed, SELinux
  autorelabel, efibootmgr on UEFI; commissioning image gains zstd/parted/xfsprogs/...
- web UI: deploy/release controls, deployment card with progress, OS catalog table
- README: deployment section, image freshness policy

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/config.example.json

@@ -12,6 +12,8 @@
   "images_dir": "/srv/rollcall/images",
   "overlays_dir": "/etc/rollcall/overlays",
   "dnsmasq_dir": "/var/lib/rollcall/dnsmasq",
+  "os_dir": "/srv/rollcall/os",
+  "os_sources": "/etc/rollcall/os-sources.json",
   "node_pools": {"mgmt": "10.213.77.50-10.213.77.99"},
   "cluster_vars": {
     "domain": "pxe.local",