A/B partition upgrades

An unprivileged DaemonSet writes two files a root systemd loop reads every 15 seconds

Password rotation and OS rollout across a Kairos fleet come down to one kubectl apply. The privileged half of the design lives in a systemd service on the host, and one of the two files it reads names the next OS image.