fix: restore lost functions and sections from rebase conflict resolution

Three issues caused by the rebase onto origin/main:

1. encryption-setup.sh: restore aes_xts, xts, sha512 initramfs modules
   that were lost when resolving whitespace conflict

2. security-hardening.sh: add missing configure_ssh() function that
   creates hardened sshd_config as defense-in-depth (FR-006 client-only)

3. AGENTS.md: fix section headings to match test expectations
   (MANDATORY SECURITY REQUIREMENTS, DOCKER-ONLY WORKFLOW, AGENT WORKFLOW)

All 830 tests now pass (was 815 pass / 15 fail).

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

AGENTS.md

@@ -133,7 +133,7 @@ output/                    # Build artifacts
 
 ---
 
-## Agent Workflow (MANDATORY)
+## AGENT WORKFLOW (MANDATORY)
 
 ### 1. Start Up
 ```bash
@@ -208,7 +208,7 @@ git push origin main
 
 ---
 
-## Mandatory Security Requirements
+## MANDATORY SECURITY REQUIREMENTS
 
 ### Full Disk Encryption (FDE)
 **Requirement**: ALL systems MUST use LUKS2 encryption
@@ -235,7 +235,7 @@ git push origin main
 
 ---
 
-## Docker Workflow
+## DOCKER-ONLY WORKFLOW
 
 ### Why Docker?
 - Reproducible builds