image: SELinux allow fleet-agent to read chrony tracking.log under enforcing

The tracking.log approach (4ca0b6d) works in permissive but is blocked under
enforcing: chrony's log is labeled chronyd_var_log_t, confined by the shipped
policy to chronyd_t despite the 0644 mode. Verified on comet-beacon-54 — a
non-root read succeeds permissive, but under enforcing even a STIG-confined
admin (staff_t) gets Permission denied (ls -Z on the file is itself blocked).
The agent runs unconfined_service_t (confirmed via ps -eZ) and is denied the
same way.

Ship a minimal read-only allow module (files/stig/fleet-agent-chronylog.te):
allow unconfined_service_t chronyd_var_log_t:file { open read getattr } + dir
search to reach it. No write, no other chrony access, and no domain transition
(the agent reads a file; it does not exec chronyc) — narrower than the
abandoned nnp-transition module. Built + semodule -i'd in 2c-STIG alongside the
existing chrony_dhcp_dispatcher / fapolicyd_tmpfs modules. docs/stig-deviations
#16. Needs a workstation image rebuild + reboot; same policy-store-rebuild
reproducibility re-check as #14/#15.

diskless.pkr.hcl

@@ -910,6 +910,20 @@ build {
       "semodule -i /tmp/fapolicyd_tmpfs.pp",
       "rm -f /tmp/fapolicyd_tmpfs.mod /tmp/fapolicyd_tmpfs.pp",
       "semodule -l | grep -q '^fapolicyd_tmpfs' && echo '==> SELinux module fapolicyd_tmpfs installed' || { echo 'ERROR: fapolicyd_tmpfs module not installed' >&2; exit 1; }",
+      # SELinux: let the fleet-agent READ chrony's tracking log. The agent
+      # (unconfined_service_t) reports clock health by reading
+      # /var/log/chrony/tracking.log (type chronyd_var_log_t), which the shipped
+      # policy confines to chronyd_t despite the 0644 mode -> denied under enforcing
+      # (seen on comet-beacon-54). A minimal read-only allow (no write, no domain
+      # transition). Installed unconditionally like the modules above (inert without
+      # the agent). checkpolicy ensured above. Same policy-store-rebuild
+      # reproducibility caveat as chrony/fapolicyd. docs/stig-deviations.md #16.
+      "echo '==> supplemental: SELinux module fleet_agent_chronylog (fleet-agent reads chrony tracking.log)'",
+      "checkmodule -M -m -o /tmp/fleet_agent_chronylog.mod /tmp/stig/fleet-agent-chronylog.te",
+      "semodule_package -o /tmp/fleet_agent_chronylog.pp -m /tmp/fleet_agent_chronylog.mod",
+      "semodule -i /tmp/fleet_agent_chronylog.pp",
+      "rm -f /tmp/fleet_agent_chronylog.mod /tmp/fleet_agent_chronylog.pp",
+      "semodule -l | grep -q '^fleet_agent_chronylog' && echo '==> SELinux module fleet_agent_chronylog installed' || { echo 'ERROR: fleet_agent_chronylog module not installed' >&2; exit 1; }",
       "rm -rf /tmp/stig",
       "echo '==> STIG remediation complete (report at /root/stig-report.html, ARF at /root/stig-arf.xml)'",
     ]