Add ntp time source and browser policy

CLAUDE.md

@@ -152,6 +152,13 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
+- NTP via DHCP option 42 → chrony (no public-pool egress): confirm on a booted
+  host `chronyc sources` lists the DHCP-handed lab server (not `*.pool.ntp.org`).
+  Assumes (a) NM exports the lease's NTP servers to the dispatcher as
+  `$DHCP4_NTP_SERVERS`, and (b) RHEL 9 `/etc/chrony.conf` honours
+  `sourcedir /run/chrony-dhcp` (the provisioner appends it if absent). If sources
+  are empty, the dispatcher didn't fire or the env var name differs — check
+  `journalctl -u NetworkManager` and `ls /run/chrony-dhcp/`.
 - `fleet` Plymouth theme: confirm (a) the script plugin package actually
   installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
   `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled