fix: resolve final PRD alignment issues, update docs

PRD Alignment Fixes:
- disable-package-management.sh: Keep dpkg-query executable for audit
  tools (was disabled despite comments claiming it was preserved)
- run.sh: Replace silent FDE skip with explicit warning message
  (PRD FR-011 says mandatory but host has no LUKS)
- run.sh: Fix checksum generation to use post-rename filename
  (was referencing live-image-amd64.hybrid.iso instead of
  knel-football-secure.iso)

Documentation Updates:
- STATUS.md: Add FR-012 to alignment matrix (was missing)
- STATUS.md: Fix stale requiretty reference (was removed)
- STATUS.md: Update PRD coverage to 12/12
- JOURNAL.md: Replace audit entry with comprehensive fix entry

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/installed/disable-package-management.sh

@@ -6,15 +6,17 @@ set -euo pipefail
 echo "Disabling package management..."
 
 # Remove execute permissions from package management tools
+# Preserve dpkg-query - needed for audit tools, security scanners, compliance checks
 chmod -x /usr/bin/apt /usr/bin/apt-get /usr/bin/dpkg 2>/dev/null || true
 chmod -x /usr/bin/apt-cache /usr/bin/apt-key /usr/bin/dpkg-deb 2>/dev/null || true
-chmod -x /usr/bin/dpkg-query /usr/bin/dpkg-split /usr/bin/dpkg-trigger 2>/dev/null || true
+chmod -x /usr/bin/dpkg-split /usr/bin/dpkg-trigger 2>/dev/null || true
 chmod -x /usr/bin/aptitude /usr/bin/synaptic /usr/bin/software-center 2>/dev/null || true
 
 # Make package management binaries immutable (prevent restoring permissions)
+# Preserve dpkg-query - needed for auditing
 chattr +i /usr/bin/apt /usr/bin/apt-get /usr/bin/dpkg 2>/dev/null || true
 chattr +i /usr/bin/apt-cache /usr/bin/apt-key /usr/bin/dpkg-deb 2>/dev/null || true
-chattr +i /usr/bin/dpkg-query /usr/bin/dpkg-split /usr/bin/dpkg-trigger 2>/dev/null || true
+chattr +i /usr/bin/dpkg-split /usr/bin/dpkg-trigger 2>/dev/null || true
 
 # Remove APT cache and lists (safe to remove - these are downloadable metadata)
 rm -rf /var/cache/apt/*