Track mesh Linux estate follow-up after PR #13

[mdheller]

Post-merge implementation backlog for the initial mesh Linux estate capture.

Scope:

• freeze distro / kernel / systemd / NetworkManager support matrix
• realize the merged templates as NixOS modules and host-role wiring
• add SELinux / AppArmor confinement for meshd-linkd and meshd-exitd
• add CI validation for example configs and unit-file linting
• define the fwmark / route-table registry canonically for the estate
• decide Release-1 packaging split and ownership boundaries

Context:

• PR docs/build(source-os): add mesh linux estate integration kit #13 merged the initial Linux-realization kit into source-os
• this issue tracks the next tranche required to move from docs/templates into a buildable estate surface