fix: resolve all audit findings in hooks, config, and package list

Security/Functional Fixes:
- firewall-setup.sh: Added WireGuard allow, established/related, DHCP
  (was blocking ALL outbound including VPN - system was non-functional)
- disable-package-management.sh: Preserve /var/lib/dpkg/ for queries
  (was destroying dpkg database with rm -rf)
- encryption-validation.sh: Fixed inverted motd conditional
  (was creating file only if it already existed - backwards)
- kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only)
  Changed user.max_user_namespaces from 0 to 100
- sudo-hardening.sh: Removed Defaults requiretty
  (was breaking GUI-launched sudo via pkexec)
- encryption-setup.sh: Fixed conflicting stdin in luksAddKey
- install-scripts.sh: Fixed embedded firewall (same WireGuard bug)
  Replaced gutted security-hardening stub with real status checker
- GRUB config: Fixed serial_console → serial (invalid terminal name)
- Package list: Removed audispd-plugins (deprecated in Debian 13),
  removed duplicate wireguard/wireguard-tools entries

Reference: Full audit findings from Session 7 JOURNAL.md

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/installed/encryption-validation.sh

@@ -153,8 +153,8 @@ EOF
 fi
 
 # Add to motd for display on login
-if [ -f /etc/update-motd.d/99-encryption ]; then
-    cat > /etc/update-motd.d/99-encryption <<'EOF'
+mkdir -p /etc/update-motd.d
+cat > /etc/update-motd.d/99-encryption <<'EOF'
 #!/bin/sh
 cat <<'EOT'
 
@@ -175,7 +175,6 @@ cat <<'EOT'
 EOT
 EOF
     chmod +x /etc/update-motd.d/99-encryption
-fi
 
 # Create systemd service to display encryption status on first boot
 cat > /etc/systemd/system/knel-encryption-firstboot.service <<'EOF'