docs: update STATUS and JOURNAL for ISO build verification session

Session 10 results: demo ISO built (825MB) and boot-verified to login
prompt via serial console in QEMU VM. STATUS updated from "ready to
build" to "built and boot-verified." JOURNAL entry documents the full
session: reproducible setup script, Dockerfile pin refresh, QEMU/TPM
fallback work, and ISO boot verification with key lessons.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

STATUS.md

@@ -1,17 +1,25 @@
 # KNEL-Football Project Status Report
 
-> **Last Updated**: 2026-05-08 (Session 9 - Remove host FDE, fix remaining partials)
+> **Last Updated**: 2026-07-30 (Session 10 - ISO built and verified)
 > **Maintained By**: AI Agent (Crush)
 > **Purpose**: Quick-glance status for project manager
 
 ---
 
-## Current Status: 🔧 ALL TECHNICAL FIXES APPLIED — READY FOR ISO BUILD
+## Current Status: ✅ ISO BUILT AND BOOT-VERIFIED
 
 ### Executive Summary
-All 39 findings from DeepReport-2026-05-08.md have been addressed.
-Host FDE requirement removed — only guest (ISO) FDE is required.
-ISO is ready to build: `./run.sh iso`
+Demo ISO built successfully (825MB) and verified booting to login prompt in QEMU VM.
+Reproducible dev environment setup script added (`scripts/setup-dev-environment.sh`).
+VM testing tooling now supports QEMU fallback when KVM is unavailable.
+
+### Build & Verification Results (Session 10)
+- **ISO**: `output/knel-football-secure.iso` (825MB, demo mode)
+- **SHA256**: `c9b11932ce0fe015274c81a13bc3202ec4b52178e8fbbe146f9d0010a09b7559`
+- **Boot test**: PASS — kernel, systemd init, live-config, reached login prompt
+- **Serial console**: `Debian GNU/Linux 13 debian ttyS0` / `debian login:`
+- **Tests**: 788 pass, 0 fail (6 new KVM/QEMU fallback tests)
+- **Lint**: 0 warnings
 
 ### Immediate Action: Build the ISO
 ```bash
@@ -79,10 +87,11 @@ ISO is ready to build: `./run.sh iso`
 
 | Item | Status |
 |------|--------|
-| Docker image | ✅ Built with new packages |
+| Docker image | ✅ Built with refreshed pins |
 | Lint (shellcheck) | ✅ 0 warnings |
-| Tests | ✅ 782 pass, 0 fail |
-| ISO build | ⬜ Ready — run `./run.sh iso` |
+| Tests | ✅ 788 pass, 0 fail |
+| ISO build | ✅ Built (demo, 825MB) |
+| ISO boot test | ✅ Reached login prompt via serial console |
 
 ---