feat: add kernel experiment workflow preflight

[dgallagher33]

Summary

• Adds a machine-specific Arch/linux-surface → linux-eiger development, boot, measurement, review, and rollback runbook.
• Adds a read-only preflight tool that records source/config/build-tool provenance before a package build.
• Adds tests for valid artifacts, unsafe labels, and strict missing-tool failure.

Validation

• python3 -m unittest discover -s tests -p "test_*.py" -v (3 passed)
• python3 -m py_compile kernel/bin/eiger-kernel-preflight
• git diff --check

Human gates retained

No package build, install, Secure-Boot signing, Limine edit, boot selection, or merge is performed by this PR.