fix: resolve critical build bugs and add missing PRD requirements

Critical fixes:
- Fix security-hardening.sh live hook: removed broken source from
  /build/src/ which doesn't exist during live-build; made hook
  self-contained by inlining all config generation
- Fix firewall-setup.sh live hook: removed broken source from
  /build/src/; hook already had inline nftables config
- Fix install-scripts.sh: replaced /workspace/src/ references with
  embedded inline scripts (installed system has no /workspace)
- Fix UKI cmdline in standalone uki_build(): added
  lockdown=confidentiality and module.sig_enforce=1 to match the
  inline Secure Boot hook
- Fix WiFi blacklist: expanded from 6 entries to 19, now covers all
  PRD FR-005 driver families (rtl*, iwl*, ath*, brcm*, mwifi*, rt2*)

Missing PRD requirements added:
- kernel-hardening.sh (FR-007): sysctl parameters for ASLR, ptrace
  restriction, kptr_restrict, dmesg_restrict, kexec disabled, SUID
  dumpable disabled, hardlink/symlink protection, network hardening
- service-hardening.sh (FR-007): disables and masks avahi-daemon,
  cups, bluetooth, NetworkManager, ModemManager, whoopsie, apport
- sudo-hardening.sh (FR-007): requiretty, logging (input/output),
  timestamp timeout, env_reset, restricted football user commands
- mount-hardening.sh (FR-007): nodev/nosuid/noexec on /tmp,
  nodev/nosuid on /home, /dev/shm hardening

Test improvements:
- Rewrote security-hardening_comprehensive_test.bats: tests now
  source scripts, call functions, and verify generated output files
- Rewrote firewall-setup_comprehensive_test.bats: tests now create
  WireGuard configs, call parse_wg_endpoint, verify nftables output
- Added new-hooks_test.bats: 42 tests for kernel hardening, service
  hardening, sudo hardening, mount hardening, self-containment
  verification, and WiFi blacklist completeness
- Total: 788 tests passing, 0 failures, 0 shellcheck warnings

Reference: docs/PRD.md FR-005, FR-007, security-model.md

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/live/kernel-hardening.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# Kernel parameter hardening - PRD FR-007
+# Reference: CIS Benchmark, NIST SP 800-53, PRD security-model.md
+set -euo pipefail
+
+echo "Applying kernel hardening parameters..."
+
+# Configure sysctl security parameters
+mkdir -p /etc/sysctl.d
+
+cat >/etc/sysctl.d/99-knel-security.conf <<'EOF'
+# KNEL-Football Kernel Security Parameters
+# Reference: PRD FR-007, CIS Benchmark 3.1-3.4, NIST SP 800-53
+
+# Enable ASLR (Address Space Layout Randomization)
+kernel.randomize_va_space = 2
+
+# Restrict ptrace (prevent process inspection by unprivileged users)
+kernel.yama.ptrace_scope = 2
+
+# Restrict access to kernel pointer addresses
+kernel.kptr_restrict = 2
+
+# Restrict dmesg to privileged users
+kernel.dmesg_restrict = 1
+
+# Restrict unprivileged use of BPF
+kernel.unprivileged_bpf_disabled = 1
+
+# Enable ExecShield-like protection
+kernel.exec-shield = 1
+
+# Restrict kernel profiling
+kernel.perf_event_paranoid = 3
+
+# Disable kexec (prevent kernel replacement)
+kernel.kexec_load = 0
+
+# Restrict access to kernel logs
+dev.tty.ldisc_autoload = 0
+
+# Restrict user namespaces
+user.max_user_namespaces = 0
+
+# Disable core dumps for SUID binaries
+fs.suid_dumpable = 0
+
+# Protect hardlinks and symlinks
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+fs.protected_fifos = 2
+fs.protected_regular = 2
+
+# Network security
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+net.ipv4.conf.default.secure_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+net.ipv6.conf.all.accept_source_route = 0
+net.ipv6.conf.default.accept_source_route = 0
+EOF
+
+# Apply sysctl settings
+sysctl --system 2>/dev/null || true
+
+echo "Kernel hardening completed."