fix: resolve 11 test failures, clean up stale files, add NVMe build cache

Test Fixes:
- Fixed grep regex matching `test:iso)` instead of `iso|iso:demo)` by
  using `grep -F` for literal string matching in 3 test files
- Increased grep context from -A 5 to -A 15 for FDE reference tests
  since FDE mention is 9+ lines into the iso command block

Stale Files:
- Deleted test-iso.sh (merged into run.sh in Session 4)
- Deleted verify.sh (orphaned, never referenced anywhere)

Documentation:
- Fixed stale test file references in COMPLIANCE.md
- Updated TEST-COVERAGE.md to remove "delegates to test-iso.sh"
- Added JOURNAL.md entry with full audit findings
- Updated STATUS.md timestamp

NVMe Build Cache (from previous session, was uncommitted):
- Added Docker volume `knel-football-cache` for build caching
- Added `clean:cache` and `cache` commands to run.sh
- Cache preserves bootstrap + package downloads between builds

Test Results: 786 pass, 0 fail, 16 VM skip

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

docs/COMPLIANCE.md

@@ -70,9 +70,9 @@ This document maps security compliance requirements to implementation components
 
 | Test Type | Test File | Validation Target | Coverage |
 |-----------|------------|-----------------|----------|
-| Unit Tests | `tests/unit/firewall_test.bats` | Firewall configuration parsing | 🔧 |
-| Unit Tests | `tests/unit/security_test.bats` | Security hardening functions | 🔧 |
-| Unit Tests | `tests/unit/build_test.bats` | Build process functions | 🔧 |
+| Unit Tests | `tests/unit/firewall-setup_test.bats` | Firewall configuration parsing | 🔧 |
+| Unit Tests | `tests/unit/security-hardening_test.bats` | Security hardening functions | 🔧 |
+| Unit Tests | `tests/unit/build-iso_comprehensive_test.bats` | Build process functions | 🔧 |
 | Integration Tests | `tests/integration/config_test.bats` | Configuration file validation | 🌐 |
 | Security Tests | `tests/security/compliance_test.bats` | Compliance verification | 🔒 |