Three issues caused by the rebase onto origin/main:
1. encryption-setup.sh: restore aes_xts, xts, sha512 initramfs modules
that were lost when resolving whitespace conflict
2. security-hardening.sh: add missing configure_ssh() function that
creates hardened sshd_config as defense-in-depth (FR-006 client-only)
3. AGENTS.md: fix section headings to match test expectations
(MANDATORY SECURITY REQUIREMENTS, DOCKER-ONLY WORKFLOW, AGENT WORKFLOW)
All 830 tests now pass (was 815 pass / 15 fail).
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
c03d3a793e