Fix fapolicyd for kiosk

docs/TODO.md

@@ -106,6 +106,24 @@ full session for seat); sshd gets an `account sufficient pam_succeed_if.so user
 keeps full STIG. Justified as register deviation #10. **Bench-verify on rebuild:
 kiosk renders + admin SSH works with hardening on.**
 
+**UPDATE 2026-06-19 — offline erofs inspection of the hardened image (mounted
+`rootfs.erofs` read-only) pinned the real causes; the PAM-account theory above
+was incomplete:**
+- **Kiosk = fapolicyd (CONFIRMED).** fapolicyd is `enabled` and `kiosk-session`
+  was not in its trust → it blocks `/usr/local/bin/kiosk-session`. Fix: KEEP
+  fapolicyd (it's the exec-guard for the writable overlay dm-verity can't cover)
+  and add the kiosk binary to its trust DB at build (2c-STIG-postfix). Not waived.
+- **SSH = NOT a STIG/PAM/SELinux issue.** `enforcing=0` didn't help; pam_namespace
+  is inert (empty namespace.conf); account bypass present; key file + perms +
+  sshd config all correct. Remaining cause: **baked key mismatch** — the
+  `SSH_AUTHORIZED_KEY` CI secret bakes `audiobuzz@s3`
+  (`SHA256:30p4vOQdWk0TdRQIR3VMo95yc6I7cRmCwIBRVjIHaV4`); if the client uses a
+  different private key → `Permission denied (publickey)`. AWAITING client
+  fingerprint / `ssh -vvv` to confirm; fix is the secret, not code.
+- Side note: SMBIOS cmdline-extra injection works only after a Proxmox VM
+  **stop/start** (not `reset`); and the debug-shell-on-tty2 attempt did not come
+  up — diagnosis ended up done via offline erofs mount instead.
+
 Remaining (future hardening, currently waived — see the register): FIPS,
 firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
 ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,