fix: resolve 11 test failures, clean up stale files, add NVMe build cache

Test Fixes:
- Fixed grep regex matching `test:iso)` instead of `iso|iso:demo)` by
  using `grep -F` for literal string matching in 3 test files
- Increased grep context from -A 5 to -A 15 for FDE reference tests
  since FDE mention is 9+ lines into the iso command block

Stale Files:
- Deleted test-iso.sh (merged into run.sh in Session 4)
- Deleted verify.sh (orphaned, never referenced anywhere)

Documentation:
- Fixed stale test file references in COMPLIANCE.md
- Updated TEST-COVERAGE.md to remove "delegates to test-iso.sh"
- Added JOURNAL.md entry with full audit findings
- Updated STATUS.md timestamp

NVMe Build Cache (from previous session, was uncommitted):
- Added Docker volume `knel-football-cache` for build caching
- Added `clean:cache` and `cache` commands to run.sh
- Cache preserves bootstrap + package downloads between builds

Test Results: 786 pass, 0 fail, 16 VM skip

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

tests/unit/build-iso_comprehensive_test.bats

@@ -237,31 +237,31 @@
 # =============================================================================
 
 @test "run.sh iso uses docker run" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "docker run"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "docker run"
 }
 
 @test "run.sh iso runs as root in container" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "\-\-user root"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "\-\-user root"
 }
 
 @test "run.sh iso uses privileged mode for loop devices" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "\-\-privileged"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "\-\-privileged"
 }
 
 @test "run.sh iso mounts workspace read-only" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "/workspace:ro"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "/workspace:ro"
 }
 
 @test "run.sh iso mounts output directory" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "/output"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "/output"
 }
 
 @test "run.sh iso sets timezone" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "TZ="
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "TZ="
 }
 
 @test "run.sh iso sets noninteractive frontend" {
-    grep -A 100 'iso)' /workspace/run.sh | grep -q "DEBIAN_FRONTEND"
+    grep -A 100 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "DEBIAN_FRONTEND"
 }
 
 # =============================================================================
@@ -285,7 +285,7 @@
 # =============================================================================
 
 @test "run.sh iso references host FDE" {
-    grep -A 10 'iso)' /workspace/run.sh | grep -qi "fde\|encryption"
+    grep -A 10 -F 'iso|iso:demo)' /workspace/run.sh | grep -qi "fde\|encryption"
 }
 
 @test "run.sh has check_host_fde function defined" {

tests/unit/run_comprehensive_test.bats

@@ -182,7 +182,7 @@
 # =============================================================================
 
 @test "run.sh iso command uses Docker" {
-    grep -A 50 'iso)' /workspace/run.sh | grep -q "docker run"
+    grep -A 50 -F 'iso|iso:demo)' /workspace/run.sh | grep -q "docker run"
 }
 
 @test "run.sh test command uses Docker" {
@@ -307,7 +307,7 @@
 }
 
 @test "run.sh iso command references host FDE" {
-    grep -A 5 'iso)' /workspace/run.sh | grep -qi "fde\|encryption"
+    grep -A 15 -F 'iso|iso:demo)' /workspace/run.sh | grep -qi "fde\|encryption"
 }
 
 @test "run.sh provides clear FDE error message" {

tests/unit/run_test.bats

@@ -132,7 +132,7 @@
 }
 
 @test "run.sh references host FDE for iso command" {
-    grep -A 5 "iso)" /workspace/run.sh | grep -qi "fde\|encryption"
+    grep -A 15 -F 'iso|iso:demo)' /workspace/run.sh | grep -qi "fde\|encryption"
 }
 
 @test "run.sh has check_host_fde function" {