fix: resolve critical build bugs and add missing PRD requirements

Critical fixes:
- Fix security-hardening.sh live hook: removed broken source from
  /build/src/ which doesn't exist during live-build; made hook
  self-contained by inlining all config generation
- Fix firewall-setup.sh live hook: removed broken source from
  /build/src/; hook already had inline nftables config
- Fix install-scripts.sh: replaced /workspace/src/ references with
  embedded inline scripts (installed system has no /workspace)
- Fix UKI cmdline in standalone uki_build(): added
  lockdown=confidentiality and module.sig_enforce=1 to match the
  inline Secure Boot hook
- Fix WiFi blacklist: expanded from 6 entries to 19, now covers all
  PRD FR-005 driver families (rtl*, iwl*, ath*, brcm*, mwifi*, rt2*)

Missing PRD requirements added:
- kernel-hardening.sh (FR-007): sysctl parameters for ASLR, ptrace
  restriction, kptr_restrict, dmesg_restrict, kexec disabled, SUID
  dumpable disabled, hardlink/symlink protection, network hardening
- service-hardening.sh (FR-007): disables and masks avahi-daemon,
  cups, bluetooth, NetworkManager, ModemManager, whoopsie, apport
- sudo-hardening.sh (FR-007): requiretty, logging (input/output),
  timestamp timeout, env_reset, restricted football user commands
- mount-hardening.sh (FR-007): nodev/nosuid/noexec on /tmp,
  nodev/nosuid on /home, /dev/shm hardening

Test improvements:
- Rewrote security-hardening_comprehensive_test.bats: tests now
  source scripts, call functions, and verify generated output files
- Rewrote firewall-setup_comprehensive_test.bats: tests now create
  WireGuard configs, call parse_wg_endpoint, verify nftables output
- Added new-hooks_test.bats: 42 tests for kernel hardening, service
  hardening, sudo hardening, mount hardening, self-containment
  verification, and WiFi blacklist completeness
- Total: 788 tests passing, 0 failures, 0 shellcheck warnings

Reference: docs/PRD.md FR-005, FR-007, security-model.md

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/installed/install-scripts.sh

@@ -4,9 +4,104 @@ set -euo pipefail
 
 echo "Installing source scripts..."
 
-# Install source scripts
-install -m 755 /workspace/src/firewall-setup.sh /usr/local/bin/
-install -m 755 /workspace/src/security-hardening.sh /usr/local/bin/
+# Install firewall-setup script (embedded - /workspace not available in installed system)
+cat >/usr/local/bin/firewall-setup.sh <<'FIREWALL_SCRIPT'
+#!/bin/bash
+set -euo pipefail
+
+parse_wg_endpoint() {
+  local wg_config="${1:-/etc/wireguard/wg0.conf}"
+  if [[ ! -f $wg_config ]]; then
+    echo "Error: WireGuard config not found at $wg_config"
+    return 1
+  fi
+  grep -oP 'Endpoint = \K[0-9.]+:[0-9]+' "$wg_config" || {
+    echo "Error: Could not parse endpoint from WireGuard config"
+    return 1
+  }
+}
+
+generate_nftables_rules() {
+  local endpoint="$1"
+  local ip="${endpoint%:*}"
+  local port="${endpoint#*:}"
+  cat <<NFTCONF
+#!/usr/sbin/nft -f
+flush ruleset
+table inet filter {
+    chain input {
+        type filter hook input priority 0; policy drop
+        iif lo accept comment "Accept loopback"
+        icmp type echo-request accept comment "Accept ping"
+    }
+    chain forward {
+        type filter hook forward priority 0; policy drop
+    }
+    chain output {
+        type filter hook output priority 0; policy drop
+        oif lo accept comment "Accept loopback"
+        udp dport "$port" ip daddr "$ip" accept comment "Allow WireGuard traffic"
+        icmp type echo-request accept comment "Allow ping"
+    }
+}
+NFTCONF
+}
+
+apply_firewall() {
+  local wg_config="${1:-/etc/wireguard/wg0.conf}"
+  if [[ -f $wg_config ]]; then
+    endpoint=$(parse_wg_endpoint "$wg_config")
+    if [[ -n $endpoint ]]; then
+      generate_nftables_rules "$endpoint" >/etc/nftables.conf
+      systemctl enable nftables
+      systemctl restart nftables
+      echo "Firewall configured for endpoint: $endpoint"
+    else
+      echo "Warning: Could not parse WireGuard endpoint, using default deny policy"
+    fi
+  else
+    echo "Warning: WireGuard config not found, using default deny policy"
+  fi
+}
+
+main() {
+  echo "Setting up dynamic firewall..."
+  apply_firewall "$@"
+  echo "Firewall setup completed."
+}
+
+if [[ ${BASH_SOURCE[0]} == "${0}" ]]; then
+  main "$@"
+fi
+FIREWALL_SCRIPT
+chmod +x /usr/local/bin/firewall-setup.sh
+
+# Install security-hardening script (embedded)
+cat >/usr/local/bin/security-hardening.sh <<'HARDENING_SCRIPT'
+#!/bin/bash
+set -euo pipefail
+
+check_encryption_status() {
+  echo "Checking encryption status..."
+  if command -v cryptsetup >/dev/null 2>&1; then
+    for dev in /dev/mapper/*; do
+      if [ -e "$dev" ]; then
+        echo "Encrypted device: $dev"
+      fi
+    done
+  fi
+}
+
+main() {
+  echo "KNEL-Football Security Hardening Utility"
+  check_encryption_status
+}
+
+if [[ ${BASH_SOURCE[0]} == "${0}" ]]; then
+  main "$@"
+fi
+HARDENING_SCRIPT
+chmod +x /usr/local/bin/security-hardening.sh
 
 # Create VPN configuration apply script
 cat >/usr/local/bin/apply-vpn-config.sh <<'EOF'