fix: resolve 11 test failures, clean up stale files, add NVMe build cache

Test Fixes:
- Fixed grep regex matching `test:iso)` instead of `iso|iso:demo)` by
  using `grep -F` for literal string matching in 3 test files
- Increased grep context from -A 5 to -A 15 for FDE reference tests
  since FDE mention is 9+ lines into the iso command block

Stale Files:
- Deleted test-iso.sh (merged into run.sh in Session 4)
- Deleted verify.sh (orphaned, never referenced anywhere)

Documentation:
- Fixed stale test file references in COMPLIANCE.md
- Updated TEST-COVERAGE.md to remove "delegates to test-iso.sh"
- Added JOURNAL.md entry with full audit findings
- Updated STATUS.md timestamp

NVMe Build Cache (from previous session, was uncommitted):
- Added Docker volume `knel-football-cache` for build caching
- Added `clean:cache` and `cache` commands to run.sh
- Cache preserves bootstrap + package downloads between builds

Test Results: 786 pass, 0 fail, 16 VM skip

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

JOURNAL.md

@@ -6,6 +6,60 @@
 
 ---
 
+## Entry 2026-05-07 (Session 7): Full Project Audit & Fix
+
+### Context
+User requested full project re-orientation. Deep audit of all hooks, tests, docs, and code against PRD.
+
+### Audit Findings
+
+#### Test Fixes (11 → 0 failures)
+- **Root cause**: `grep 'iso)'` regex matched `test:iso)` before `iso|iso:demo)` due to `|` being regex OR
+- **Fix**: Changed all affected greps to use `grep -F 'iso|iso:demo)'` (literal string match)
+- **Files fixed**: `tests/unit/build-iso_comprehensive_test.bats` (8), `tests/unit/run_comprehensive_test.bats` (2), `tests/unit/run_test.bats` (1)
+- Also increased grep context from `-A 5` to `-A 15` for FDE reference tests (content is 9+ lines into iso block)
+
+#### Stale Files Deleted
+- `test-iso.sh` - merged into run.sh in Session 4, was still in repo
+- `verify.sh` - orphaned, never referenced, duplicated `run.sh test`
+
+#### Documentation Fixes
+- `docs/TEST-COVERAGE.md` line 23: Updated stale "delegates to test-iso.sh" reference
+- `docs/COMPLIANCE.md` lines 73-75: Fixed wrong test filenames (firewall_test → firewall-setup_test, etc.)
+
+#### Uncommitted run.sh Changes (carried over from last session)
+- Added `CACHE_VOLUME` for NVMe build cache via Docker volume
+- Added `clean:cache` and `cache` commands
+- Build cache restore/save around `lb build` for faster iteration
+- Cache preserves bootstrap + package downloads between builds (~5 min saved)
+
+### Known Issues Identified (not fixed this session - deferred)
+
+| Issue | Severity | Notes |
+|-------|----------|-------|
+| `firewall-setup.sh` live hook blocks all outbound | High | Static default-deny, no WireGuard allow; live system has no network |
+| `disable-package-management.sh` destroys dpkg db | High | `rm -rf /var/lib/dpkg/*` breaks anything querying installed packages |
+| `encryption-validation.sh` inverted conditional | Medium | motd file created only if it already exists (backwards) |
+| `kernel.exec-shield = 1` in kernel-hardening.sh | Low | Red Hat-specific, doesn't exist on Debian |
+| `src/build-iso.sh` $VERSION undefined | Medium | Build always reports failure even on success |
+| NTFS mount needs ntfs-3g but not in package list | Low | USB automount will fail for NTFS drives |
+| `audispd-plugins` may not exist in Debian 13 | Low | Deprecated/removed from trixie |
+
+### Test Results
+```
+786 tests, 0 failures, 16 VM skips
+Lint: 0 shellcheck warnings
+ISO: 824 MB, built 2026-05-01
+```
+
+### Verification
+```bash
+./run.sh lint    # Zero warnings
+./run.sh test    # 786 pass, 0 fail, 16 skip (VM)
+```
+
+---
+
 ## Entry 2026-02-20 (Session 6): Security Audit Findings Implementation
 
 ### Context