fix: use system libvirt with /tmp storage for virt-manager visibility

- Changed from qemu:///session to qemu:///system so VMs appear in virt-manager
- Store disk and ISO in /tmp (user-writable, no sudo needed)
- User is in libvirt group so can access system libvirt without sudo
- Updated test to expect system URI

This fixes the regression where VMs were not visible in virt-manager.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

docs/audit/2026-02-20/SUMMARY.md

@@ -0,0 +1,115 @@
+# KNEL-Football Secure OS - Executive Summary
+
+**Audit Date**: 2026-02-20
+**Auditor**: External Security Auditor
+**Classification**: CONFIDENTIAL
+
+---
+
+## Project Overview
+
+KNEL-Football is a hardened Debian 13 Linux distribution designed as a **secure remote terminal** for accessing tier0 infrastructure via WireGuard VPN. The project implements a two-factor security model requiring both physical possession of the device and access to a privileged workstation.
+
+---
+
+## Audit Scope
+
+- Security architecture review
+- Encryption configuration validation
+- Build system and supply chain analysis
+- SDLC compliance verification
+- Code quality assessment
+- Firewall and network security review
+
+---
+
+## Risk Assessment
+
+### Overall Risk Level: **MEDIUM**
+
+| Severity | Count | Key Areas |
+|----------|-------|-----------|
+| Critical | 0 | - |
+| High | 2 | Secure Boot keys, Firewall output |
+| Medium | 4 | Docker privileged, USB automount, KDF config, Supply chain |
+| Low | 3 | Test gaps, Documentation, Input validation |
+| Info | 1 | Package management |
+
+---
+
+## Critical Findings Requiring Immediate Attention
+
+### 1. Secure Boot Key Management (HIGH)
+Keys generated at build time without HSM or secure storage. An attacker with build system access could extract private keys and sign malicious bootloaders.
+
+**Impact**: Complete chain of trust compromise
+**Effort**: Medium (requires key management infrastructure)
+
+### 2. Firewall Output Chain Blocks Essential Services (HIGH)
+Default DROP policy on OUTPUT chain prevents DNS resolution, NTP synchronization, and system updates.
+
+**Impact**: System cannot function properly (DNS, time sync, updates)
+**Effort**: Low (add explicit allow rules)
+
+---
+
+## Positive Security Observations
+
+1. **Strong SDLC Enforcement** - Pre-commit hooks enforce TDD, linting, and coverage
+2. **Comprehensive Encryption** - LUKS2 with AES-256-XTS-512, passphrase validation
+3. **Defense in Depth** - Multiple layers: FDE, firewall, audit, FIM, hardening
+4. **No SSH Server** - Correctly implements client-only SSH per requirements
+5. **Clean Code Quality** - All scripts pass shellcheck with zero warnings
+6. **Host FDE Enforcement** - Build system refuses to run without host encryption
+
+---
+
+## Recommendations Priority
+
+### Must Fix Before Release
+1. Fix firewall OUTPUT chain to allow DNS/NTP/updates
+2. Disable USB automount (conflicts with security model)
+3. Verify Argon2id KDF is actually used in LUKS
+
+### Short-term (30 days)
+1. Implement Secure Boot key management with HSM or air-gapped storage
+2. Pin Docker package versions for reproducible builds
+3. Add functional integration tests for encryption
+
+### Long-term (90 days)
+1. Implement SLSA/SBOM for supply chain security
+2. Add USB authorization with usbguard
+3. Build environment attestation
+
+---
+
+## Compliance Status
+
+| Standard | Status | Notes |
+|----------|--------|-------|
+| NIST SP 800-53 SC-8 | ✅ Pass | WireGuard encryption |
+| NIST SP 800-53 SC-12 | ⚠️ Issue | Key management needs work |
+| NIST SP 800-53 AC-19 | ⚠️ Issue | USB automount |
+| NIST SP 800-111 | ✅ Pass | LUKS2 encryption |
+| CIS Benchmark 6.x | ✅ Pass | Comprehensive audit logging |
+| FedRAMP SC-7 | ⚠️ Issue | Firewall output policy |
+
+---
+
+## Audit Artifacts
+
+- `docs/audit/2026-02-20/findings.md` - Detailed findings (10 findings)
+- `docs/audit/2026-02-20/SUMMARY.md` - This document
+
+---
+
+## Conclusion
+
+KNEL-Football demonstrates **mature security architecture** with strong foundations. The project is **suitable for production with remediation** of the two HIGH findings. The SDLC practices are exemplary and should be maintained.
+
+**Recommendation**: Address firewall and Secure Boot key issues before release. The remaining findings can be addressed post-release with documented timelines.
+
+---
+
+**Signed**: External Security Auditor
+**Date**: 2026-02-20