Merge debug/prod into single ISO build, fix NVIDIA module loading

## ISO build consolidation
- Remove separate debug/prod split: overlay-debug/, build-debug.sh,
  mkimg.bee_debug.sh, genapkovl-bee_debug.sh all deleted
- Single overlay: iso/overlay/ (was overlay-debug content)
- Single build script: build.sh (SSH, TUI, NVIDIA, vendor tools, bee-release)
- Single mkimage profile: bee (with dropbear, dialog, strace, gcompat, etc.)

## NVIDIA fixes
- Modules now stored at /usr/local/lib/nvidia/ instead of
  /lib/modules/<kver>/extra/nvidia/ — modloop squashfs mounts over that
  path at boot making overlay content there inaccessible
- bee-nvidia init: load via insmod (absolute path), not modprobe
- bee-nvidia init: create libnvidia-ml.so.1/libcuda.so.1 symlinks in /usr/lib/
- build-nvidia-module.sh: always install linux-lts-dev (not conditional) —
  stale 6.6.x headers caused wrong-kernel modules that never loaded at runtime
- build-nvidia-module.sh: create soname symlinks in cache
- KERNEL_VERSION in VERSIONS updated 6.6 → 6.12
- gcompat added to ISO packages (nvidia-smi is a glibc binary on musl Alpine)

## Service ordering
- bee-audit: add `after bee-nvidia` so NVIDIA enrichment always succeeds

## New tooling
- iso/builder/smoketest.sh: SSH smoke test for post-boot ISO validation
- iso/builder/build-gpu-burn.sh: builds gpu_burn vendor binary (CUDA 12.8+)
- vendor/gpu_burn included automatically if placed in iso/vendor/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build-nvidia-module.sh

@@ -20,6 +20,11 @@ DIST_DIR="$2"
 [ -n "$NVIDIA_VERSION" ] || { echo "usage: $0 <nvidia-version> <dist-dir>"; exit 1; }
 [ -n "$DIST_DIR" ]       || { echo "usage: $0 <nvidia-version> <dist-dir>"; exit 1; }
 
+# Always install linux-lts-dev to ensure headers match the ISO's kernel (Alpine 3.21 = 6.12.x).
+# Without this, a builder with stale 6.6.x headers produces modules for the wrong kernel version.
+echo "=== installing linux-lts-dev ==="
+apk add --quiet linux-lts-dev
+
 # Detect kernel version from installed headers (pick highest version if multiple).
 detect_kver() {
     ls /usr/src/ 2>/dev/null \
@@ -30,11 +35,6 @@ detect_kver() {
 }
 
 KVER="$(detect_kver)"
-if [ -z "$KVER" ]; then
-    echo "=== installing linux-lts-dev ==="
-    apk add --quiet linux-lts-dev
-    KVER="$(detect_kver)"
-fi
 KDIR="/usr/src/linux-headers-${KVER}"
 echo "=== NVIDIA ${NVIDIA_VERSION} (proprietary) for kernel ${KVER} ==="
 
@@ -107,6 +107,15 @@ cp "$EXTRACT_DIR/libnvidia-ml.so."*  "$CACHE_DIR/lib/" 2>/dev/null || true
 # libcuda stub needed by nvidia-smi at runtime
 cp "$EXTRACT_DIR/libcuda.so."*       "$CACHE_DIR/lib/" 2>/dev/null || true
 
+# Create soname symlinks required by nvidia-smi on Alpine (musl/glibc via gcompat)
+for lib in libnvidia-ml libcuda; do
+    versioned=$(ls "$CACHE_DIR/lib/${lib}.so."[0-9]* 2>/dev/null | head -1)
+    [ -n "$versioned" ] || continue
+    base=$(basename "$versioned")
+    ln -sf "$base" "$CACHE_DIR/lib/${lib}.so.1" 2>/dev/null || true
+    ln -sf "${lib}.so.1" "$CACHE_DIR/lib/${lib}.so" 2>/dev/null || true
+done
+
 echo "=== NVIDIA build complete ==="
 echo "cache: $CACHE_DIR"
 echo "modules: $(ls "$CACHE_DIR/modules/"*.ko | wc -l) .ko files"