fix: resolve 15 CRITICAL/HIGH/MEDIUM audit findings from DeepReport

Addresses findings C-02, C-05, H-01, H-02, H-03, H-04, H-07, H-08,
M-01, M-02, M-05, M-07, M-08, M-12, plus encryption script fixes.

Changes:
- run.sh: Enforce host FDE check (C-02), make sbverify fatal (H-07),
  add module.sig_enforce to Docker-embedded UKI (H-08)
- usb-automount.sh: Add noexec,nosuid,nodev mount options (C-05),
  restrict dmask/fmask, add input validation, add audit logging (M-08)
- security-hardening.sh (live): Set StrictHostKeyChecking yes (H-01),
  remove sshd_config generation (H-02), expand WiFi blacklist (M-12)
- firewall-setup.sh (live): Remove inbound ICMP echo, narrow WG port
  range to 51820 only (M-05)
- firewall-setup.sh (src): Add ct state established,related (H-03)
- security-hardening.sh (src): Fix apply_security_hardening to call
  configure_ssh_client and configure_fim with separate output paths (M-01)
- install-scripts.sh: Remove football from sudo group (M-02)
- mount-hardening.sh: Ensure /tmp,/var/tmp,/dev/shm always hardened
  even without existing fstab entries (M-07)
- encryption-setup.sh: Fix cryptsetup stdin syntax (H-05), add dynamic
  LUKS device discovery (H-06), fix recovery key generation (M-04),
  fix crypttab sed pattern
- qr-code-import.sh: Restrict temp file permissions (H-04)
- Tests updated to match new security posture

All 786+ tests pass. Zero shellcheck warnings.

Reference: DeepReport-2026-05-08.md findings C-02, C-05, H-01 through
H-08, M-01, M-02, M-05, M-07, M-08, M-12

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/installed/mount-hardening.sh

@@ -5,46 +5,35 @@ set -euo pipefail
 
 echo "Applying mount point hardening..."
 
-# Create fstab security entries for temporary filesystems
-# These are added via a systemd mount helper or tmpfiles.d
-# since fstab is managed by the installer for the main partitions
+FSTAB="/etc/fstab"
 
-# Harden /tmp via tmpfiles.d (systemd-tmpfiles)
-mkdir -p /etc/tmpfiles.d
+# Ensure fstab exists
+touch "$FSTAB"
 
-cat >/etc/tmpfiles.d/knel-mount-hardening.conf <<'EOF'
-# KNEL-Football Mount Hardening
-# Ensure /tmp is mounted with nodev, nosuid, noexec
-# This supplements the installer-created fstab
-d /tmp 1777 root root 0d
-EOF
-
-# Add security mount options to fstab if entries exist
-if [ -f /etc/fstab ]; then
-    # Harden /tmp if present
-    if grep -q '/tmp' /etc/fstab 2>/dev/null; then
-        sed -i '/\/tmp/s/defaults/defaults,nodev,nosuid,noexec/' /etc/fstab 2>/dev/null || true
-    fi
-
-    # Harden /var/tmp if present
-    if grep -q '/var/tmp' /etc/fstab 2>/dev/null; then
-        sed -i '/\/var\/tmp/s/defaults/defaults,nodev,nosuid,noexec/' /etc/fstab 2>/dev/null || true
-    fi
-
-    # Harden /home if present
-    if grep -q '/home' /etc/fstab 2>/dev/null; then
-        sed -i '/\/home/s/defaults/defaults,nodev,nosuid/' /etc/fstab 2>/dev/null || true
-    fi
-
-    # Harden /dev/shm if present
-    if grep -q '/dev/shm' /etc/fstab 2>/dev/null; then
-        sed -i '/\/dev\/shm/s/defaults/defaults,nodev,nosuid,noexec/' /etc/fstab 2>/dev/null || true
-    fi
+# Harden /tmp if present in fstab, otherwise add tmpfs entry
+if grep -q '/tmp' "$FSTAB" 2>/dev/null; then
+    sed -i '/\/tmp/s/defaults/defaults,nodev,nosuid,noexec/' "$FSTAB" 2>/dev/null || true
+else
+    echo "tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,size=2G 0 0" >> "$FSTAB"
 fi
 
-# If /tmp is NOT in fstab, add a tmpfs entry with hardening
-if ! grep -q '/tmp' /etc/fstab 2>/dev/null; then
-    echo "tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,size=2G 0 0" >> /etc/fstab
+# Harden /var/tmp if present, otherwise add tmpfs entry
+if grep -q '/var/tmp' "$FSTAB" 2>/dev/null; then
+    sed -i '/\/var\/tmp/s/defaults/defaults,nodev,nosuid,noexec/' "$FSTAB" 2>/dev/null || true
+else
+    echo "tmpfs /var/tmp tmpfs defaults,nodev,nosuid,noexec,size=512M 0 0" >> "$FSTAB"
+fi
+
+# Harden /dev/shm if present, otherwise add tmpfs entry
+if grep -q '/dev/shm' "$FSTAB" 2>/dev/null; then
+    sed -i '/\/dev\/shm/s/defaults/defaults,nodev,nosuid,noexec/' "$FSTAB" 2>/dev/null || true
+else
+    echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec,size=512M 0 0" >> "$FSTAB"
+fi
+
+# Harden /home if it has its own partition
+if grep -q '/home' "$FSTAB" 2>/dev/null; then
+    sed -i '/\/home/s/defaults/defaults,nodev,nosuid/' "$FSTAB" 2>/dev/null || true
 fi
 
 echo "Mount hardening completed."