Change email notification to syslog

docs/stig-deviations.md

@@ -76,6 +76,13 @@ private keys stored on the host; host keys regenerate per boot).
   MTA is dead attack surface. This also makes `postfix_prevent_unrestricted_relay`
   N/A. Audit-failure notification relies on the remote offload, not email
   (`auditd ... action_mail_acct` stays configured but is not the alerting path).
+- `auditd_data_retention_space_left_action` — **consequence of removing postfix.**
+  STIG sets `space_left_action = email`, but with no MTA auditd logs *"Email
+  option is specified but /usr/lib/sendmail doesn't seem executable"* at every
+  boot and can't send. 2c-STIG repoints **`space_left_action = SYSLOG`** so the
+  75%-full alert rides the remote audit offload (2f) instead; this rule wants
+  `email`, so it's waived. `admin_space_left_action` stays `single` (the critical
+  action, unaffected) and `action_mail_acct = root` stays set.
 
 **Remediated to pass (not waived):**
 - `configure_usbguard_auditbackend` + `usbguard_allow_hid` / `usbguard_allow_hub`