cook: ship the fscrypt stack by default in Phyllome OS

- ingredients/repo/phyllome.ks: add the git.phyllo.me roots registry as a
  downstream repo (install-time only; the phyllome-fscrypt package owns
  /etc/yum.repos.d/phyllome.repo on the installed system)
- ingredients/packages/fscrypt.ks: install phyllome-fscrypt, which pulls
  fscrypt + pam_fscrypt via Requires
- recipe_templates: new 'fscrypt' feature mapping the two fragments
- recipes_manifest: enable fscrypt for phyllomeos and phyllomeos-headless
  (default tier, repository 44)

make lint/validate/test pass; both default dishes regenerate with the
phyllome repo and phyllome-fscrypt included.

cook/recipe_templates.yaml

@@ -74,6 +74,10 @@ features:
     intelgpu: hypervisor/intelgpu.ks
   hardware-support: packages/hardware-support.ks
   guest-agents: guest-agents/base.ks
+  fscrypt:
+    true:
+      - repo/phyllome.ks
+      - packages/fscrypt.ks
   live:
     true:
       - live/core/base.ks