feat: enforce SDLC compliance with pre-commit hook and documentation

- Add .git/hooks/pre-commit for automatic SDLC enforcement
  - Blocks commits on lint warnings
  - Blocks commits on test failures
  - Checks test coverage for modified files
  - Warns on missing documentation updates

- Update AGENTS.md with mandatory SDLC compliance section
  - Visual workflow diagram
  - Zero tolerance policy
  - Pre-commit hook documentation

- Fix SC2012 lint warnings in run.sh (lines 74, 551)
  - Changed ls | head to find -print -quit

- Add FR-012 Secure Boot with UKI to docs/PRD.md
  - Trust chain requirements
  - Key specifications (RSA-4096, SHA-256, 3650 days)
  - Kernel lockdown requirements

- Update docs/security-model.md with Secure Boot trust chain
  - Full trust chain diagram
  - Key hierarchy
  - Kernel lockdown effects

- Update docs/TEST-COVERAGE.md with Secure Boot tests

- Add tests/unit/secureboot_test.bats (70+ tests for Secure Boot)

- Fix test bugs in build-iso and run comprehensive tests
  - Changed distribution from 'testing' to 'trixie'
  - Fixed Secure Boot key test patterns for multiline matches

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

run.sh

@@ -71,7 +71,7 @@ check_host_fde() {
     fi
     
     # Method 4: Check for dm-crypt devices in /sys/block
-    if ls /sys/block/dm-* 2>/dev/null | head -1 | grep -q .; then
+    if find /sys/block -maxdepth 1 -name 'dm-*' -print -quit 2>/dev/null | grep -q .; then
         for dm_dev in /sys/block/dm-*; do
             if [[ -f "${dm_dev}/dm/name" ]]; then
                 local dm_name
@@ -548,7 +548,7 @@ uki_build() {
     log_info "Building Unified Kernel Image (UKI)..."
     
     # Find kernel version
-    kernel_version=$(ls "${build_dir}/chroot/boot/vmlinuz-"* 2>/dev/null | head -1 | sed 's/.*vmlinuz-//')
+    kernel_version=$(find "${build_dir}/chroot/boot" -maxdepth 1 -name 'vmlinuz-*' -print -quit 2>/dev/null | sed 's/.*vmlinuz-//')
     if [[ -z "$kernel_version" ]]; then
         log_error "Kernel not found in chroot"
         return 1