feat: serial console on test VMs for debugging without SSH

- VMs get serial console on TCP (PXE: port 4555, ISO: port 4556)
- serialExec() helper: runs commands via telnet when SSH/network is down
- PXE test: on SSH failure, dumps hostname, IP, NetworkManager, sshd,
  failed units, and fstab via serial console before failing
- Kickstart enables serial-getty@ttyS0 for auto-login on serial

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/bastion/src/templates/install.ks.ts

@@ -447,6 +447,9 @@ systemctl mask firewalld || true
 # -- Enable chronyd for time sync --
 systemctl enable chronyd || true`}
 
+# -- Serial console (for debugging — auto-login as root on ttyS0) --
+systemctl enable serial-getty@ttyS0.service || true
+
 # -- Boot order: restore network first (Anaconda sets disk first, we undo it) --
 # Network boot must stay first so the bastion intercepts every reboot. It returns
 # exit (local disk) for installed machines, or install for reinstalls.