Fix fapolicyd for kiosk

docs/stig-deviations.md

@@ -37,6 +37,12 @@ Posture decisions (2026-06-18, lab phase):
 ## Things that are NOT deviations (kept / enforced)
 
 - **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).
+- **fapolicyd** kept **enabled** (NOT waived) — it's the real exec-allowlist guard
+  for the writable RAM overlay, which dm-verity does **not** cover. The only
+  adjustment: the one non-RPM executable, `/usr/local/bin/kiosk-session`, is added
+  to fapolicyd's trust DB at build (provisioner 2c-STIG-postfix) so the kiosk runs;
+  everything else stays RPM-trust-only. (fapolicyd blocking that binary was the
+  original kiosk-won't-start cause.)
 - **auditd** enabled; STIG audit rules applied; logs locally.
 - **sshd hardening**: root login off, password & keyboard-interactive auth off,
   key-only (drop-in `50-fleet-hardening.conf`); STIG ciphers/MACs/KEX applied.