feat(toml): per-section enable flags + [packages.steam] + [deployment] targets

Commit 1 of 3 in the configurator-as-SSOT chain. Operator instruction:

  "MiOS Defaults are all pre-checked on, excluding bloat and including
   everything else (steamos, proton/wine11+, ALL the self; dev, build,
   host, hosting self, run, deploy all target images / build target
   images for ALL deployment types) -- EVERYTHING!!!"

Schema additions:

1. `enable = true|false` on every [packages.<section>] table (44 in
   total). Default ON for all 43 sections; default OFF only for
   [packages.bloat] (gnome-tour, malcontent-*, PackageKit-* --
   intentionally bloat). The configurator HTML's package toggles
   write to this field; the build resolver checks it before running
   dnf install <section>.

2. New [packages.steam] section with 10 packages: steam, wine,
   wine-staging, winetricks, lutris, gamescope, mangohud, vkbasalt,
   goverlay, protontricks. RPM Fusion (already in [packages.repos])
   is the source. Default ON. Added "steam" to [packages].sections
   master inclusion list. SteamOS-equivalent surface; the flatpak
   Steam at com.valvesoftware.Steam can layer on top via
   [packages].flatpaks for the sandboxed runner alternative.

3. New [deployment] section with 8 target-format toggles for
   bootc-image-builder:

     target_vhdx           true   Hyper-V VM disk (Windows guests, Azure)
     target_qcow2          true   QEMU/KVM disk (libvirt, Proxmox, Boxes)
     target_iso            true   bootable ISO (live + installer)
     target_raw            true   raw disk image (bare-metal write)
     target_wsl            true   WSL2 rootfs tarball
     target_ami            false  AWS AMI (needs aws-cli + signing)
     target_ova            false  vSphere OVA (needs ovftool)
     target_anaconda_iso   false  Anaconda installer ISO (slower build)

   Default = the 5 build-driver currently produces (matches
   MIOS_BIB_FORMATS="vhdx qcow2 iso raw wsl" hardcoded today).
   Operators can flip ami/ova/anaconda_iso ON via configurator
   when they have the prerequisite tools / accounts.

The [packages].sections array stays as the canonical "what groups
exist" list. The build resolver should respect BOTH it and the
per-section enable flag (group is installed only if it's in
sections AND enable=true). That's a small change in
automation/lib/packages.sh -- not in this commit, since it can't
be tested until the configurator HTML can WRITE the flags. Coming
in commit 3 of this chain.

Validated with `python3 -m tomllib`:
  steam in [packages].sections:      True
  [packages.steam].enable:           True
  [packages.steam] pkg count:        10
  Sections missing enable= field:    none (all 44 have it)
  [packages.bloat].enable:           False
  [deployment] ON-by-default:        vhdx, qcow2, iso, raw, wsl
  [deployment] OFF-by-default:       ami, ova, anaconda_iso

Next commits in the chain:
  2/3  Configurator HTML: expose every [packages.<section>].enable
       AND every [deployment].target_<X> as a checkbox, all
       pre-checked except bloat / ami / ova / anaconda_iso.
  3/3  Build pipeline: automation/lib/packages.sh respects the
       enable flag; mios-build-driver reads MIOS_DEPLOY_<TARGET>
       (synthesized by tools/lib/userenv.sh) and assembles
       BIB_FORMATS dynamically.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94