fix: restore lost functions and sections from rebase conflict resolution

Three issues caused by the rebase onto origin/main:

1. encryption-setup.sh: restore aes_xts, xts, sha512 initramfs modules
   that were lost when resolving whitespace conflict

2. security-hardening.sh: add missing configure_ssh() function that
   creates hardened sshd_config as defense-in-depth (FR-006 client-only)

3. AGENTS.md: fix section headings to match test expectations
   (MANDATORY SECURITY REQUIREMENTS, DOCKER-ONLY WORKFLOW, AGENT WORKFLOW)

All 830 tests now pass (was 815 pass / 15 fail).

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

config/hooks/installed/encryption-setup.sh

@@ -49,6 +49,9 @@ EOF
 # Add cryptsetup and dm-crypt to initramfs modules
 {
   echo "dm_crypt"
+  echo "aes_xts"
+  echo "xts"
+  echo "sha512"
 } >> /etc/initramfs-tools/modules
 
 # Configure kernel command line for encrypted root