Merge branch 'stig' into secureboot

diskless.pkr.hcl

@@ -543,6 +543,13 @@ build {
       #     is waived in the tailoring to match.
       "echo '==> supplemental: removing unused MTA (postfix)'",
       "dnf remove -y postfix >/dev/null 2>&1 || true",
+      # Removing postfix leaves auditd's STIG `space_left_action = email` with no
+      # MTA (it warns at boot and can't send). Repoint the 75%-full alert to
+      # SYSLOG so it rides the remote audit offload (2f) instead. Only
+      # space_left_action changes; admin_space_left_action stays `single` (STIG).
+      # The auditd_data_retention_space_left_action rule (wants email) is waived in
+      # the tailoring to match — see docs/stig-deviations.md #12.
+      "[ -f /etc/audit/auditd.conf ] && sed -i 's/^space_left_action[[:space:]]*=.*/space_left_action = SYSLOG/' /etc/audit/auditd.conf || true",
       # (b) USBGuard: usbguard is already installed + enabled, but its policy was
       #     generated on the build VM (no real USB input). Add the LinuxAudit audit
       #     backend (configure_usbguard_auditbackend) AND a hardware-independent