cook: ship the fscrypt stack by default in Phyllome OS

- ingredients/repo/phyllome.ks: add the git.phyllo.me roots registry as a
  downstream repo (install-time only; the phyllome-fscrypt package owns
  /etc/yum.repos.d/phyllome.repo on the installed system)
- ingredients/packages/fscrypt.ks: install phyllome-fscrypt, which pulls
  fscrypt + pam_fscrypt via Requires
- recipe_templates: new 'fscrypt' feature mapping the two fragments
- recipes_manifest: enable fscrypt for phyllomeos and phyllomeos-headless
  (default tier, repository 44)

make lint/validate/test pass; both default dishes regenerate with the
phyllome repo and phyllome-fscrypt included.

cook/recipes_manifest.yaml

@@ -36,6 +36,7 @@ recipes:
         initial-setup: gnome
         hardware-support: true
         guest-agents: true
+        fscrypt: true
         hypervisor: desktop
         hypervisor_type: any
 
@@ -50,6 +51,7 @@ recipes:
         initial-setup: server
         hardware-support: true
         guest-agents: true
+        fscrypt: true
         hypervisor: base
         hypervisor_type: any