stig: ship fapolicyd_tmpfs SELinux module — close overlay exec-guard gap

fapolicyd is the app-allowlisting exec guard for the writable RAM overlay
(dm-verity covers only the read-only erofs lower). It statfs's mounts to decide
which to watch, and tmpfs is in its default watch_fs. This image's root is
systemd.volatile=overlay, so statfs("/") returns the overlay upper — a tmpfs —
and the shipped policy has no 'fapolicyd_t tmpfs_t:filesystem getattr' (no
ordinary host roots on tmpfs). Under enforcing the getattr is DENIED (audit:
dev=tmpfs ino=1 name="/", permissive=0, seen 2026-07-03 on comet-beacon-54),
so fapolicyd can't fully mark the tmpfs mounts (/, /tmp, /dev/shm) and its guard
over the writable overlay is incomplete — a real exec-guard gap, not just SIEM
noise.

Ship a minimal local allow module (allow, not dontaudit — we want fapolicyd to
see the tmpfs), compiled + semodule -i'd in 2c-STIG right after the chrony one.
Registered as deviation #15.

BENCH-VERIFY: the AVC is gone on an enforcing boot AND fapolicyd blocks a non-RPM
executable dropped in /tmp (proves the guard now covers the overlay), trusted
kiosk/appliance binaries still run, and the verity hash is reproducible across
two builds (semodule rebuilds the policy store).

diskless.pkr.hcl

@@ -730,6 +730,21 @@ build {
       "semodule -i /tmp/chrony_dhcp_dispatcher.pp",
       "rm -f /tmp/chrony_dhcp_dispatcher.mod /tmp/chrony_dhcp_dispatcher.pp",
       "semodule -l | grep -q '^chrony_dhcp_dispatcher' && echo '==> SELinux module chrony_dhcp_dispatcher installed' || { echo 'ERROR: chrony_dhcp_dispatcher module not installed' >&2; exit 1; }",
+      # SELinux: allow fapolicyd to statfs (getattr) tmpfs. fapolicyd is the exec
+      # guard for the WRITABLE overlay (dm-verity covers only the RO erofs lower);
+      # it statfs's mounts to decide which to watch (tmpfs is in its default
+      # watch_fs). This host's root is systemd.volatile=overlay, so statfs("/")
+      # lands on the tmpfs upper (audit: dev=tmpfs ino=1 name="/") and the shipped
+      # policy denies it -> fapolicyd can't fully guard the tmpfs mounts (/, /tmp,
+      # /dev/shm) — a real exec-guard gap. Ship a minimal allow (docs/stig-deviations.md).
+      # checkpolicy already ensured above. Same policy-store-rebuild reproducibility
+      # caveat as chrony.
+      "echo '==> supplemental: SELinux module fapolicyd_tmpfs (fapolicyd statfs the volatile-overlay tmpfs)'",
+      "checkmodule -M -m -o /tmp/fapolicyd_tmpfs.mod /tmp/stig/fapolicyd-tmpfs.te",
+      "semodule_package -o /tmp/fapolicyd_tmpfs.pp -m /tmp/fapolicyd_tmpfs.mod",
+      "semodule -i /tmp/fapolicyd_tmpfs.pp",
+      "rm -f /tmp/fapolicyd_tmpfs.mod /tmp/fapolicyd_tmpfs.pp",
+      "semodule -l | grep -q '^fapolicyd_tmpfs' && echo '==> SELinux module fapolicyd_tmpfs installed' || { echo 'ERROR: fapolicyd_tmpfs module not installed' >&2; exit 1; }",
       "rm -rf /tmp/stig",
       "echo '==> STIG remediation complete (report at /root/stig-report.html, ARF at /root/stig-arf.xml)'",
     ]