Adding rsyslog tls

CLAUDE.md

@@ -254,7 +254,17 @@ instead of working around it.
   `sourcedir /run/chrony-dhcp` (the provisioner appends it if absent). If sources
   are empty, the dispatcher didn't fire or the env var name differs — check
   `journalctl -u NetworkManager` and `ls /run/chrony-dhcp/`.
-- `fleet` Plymouth theme: confirm (a) the script plugin package actually
+- TLS audit offload (2f → `serving/audit-collector`, gtls/6514, since
+  2026-07-12): the plaintext-514 path was bench-verified; the TLS upgrade is
+  NOT yet. On a booted host confirm the sender is ESTABLISHED to **:6514**
+  (not the legacy :514), records land in `audit-collector/logs/<ip>/`, and a
+  wrong CA is rejected (sender spools + logs a cert-validation error — proves
+  x509/name is enforced). Prereqs: collector cert issued
+  (`audit-collector/issue-cert.sh`, SAN = `audit.fleet.lab`, same step-ca as
+  the build's `fleet_ca`), 6514/tcp open on the boot NIC (host-networked —
+  same ufw trap as 514), image built with the real fleet CA. The three
+  `rsyslog_encrypt_offload_*` STIG rules are enforced (waivers dropped) and
+  must PASS in the report.
   installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
   `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled
   into the initramfs (`lsinitrd | grep -E 'fleet.script|script.so'`), and (c) it
@@ -316,7 +326,9 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress.
   dangerous-to-remediate rules; every waiver is justified in
   `docs/stig-deviations.md`). STIG kernel params ride the **UKI cmdline**
   (`extract-artifacts.sh`, gated by the same flag) since there's no GRUB.
-  **FIPS is OFF and audit offload is LOCAL-only** (decisions). CI is
+  **FIPS is OFF** (decision); audit offload is **remote over syslog-TLS**
+  (2f → `serving/audit-collector`, gtls/6514, fleet-CA x509/name; empty
+  `audit_host` = local-only). CI is
   **report-only**: it publishes `stig-report.html` + `stig-arf.xml` +
   `stig-deviations.md` (generated by `scripts/stig-deviations.sh`) as artifacts
   and never fails on score. The scanner tooling is removed from the shipped image