Add Host API and fix kiosk performance

docs/stig-deviations.md

@@ -143,10 +143,13 @@ hotkey disabled (e.g. a physically exposed terminal), re-select both rule IDs.
 - **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).
 - **fapolicyd** kept **enabled** (NOT waived) — it's the real exec-allowlist guard
   for the writable RAM overlay, which dm-verity does **not** cover. The only
-  adjustment: the one non-RPM executable, `/usr/local/bin/kiosk-session`, is added
-  to fapolicyd's trust DB at build (provisioner 2c-STIG-postfix) so the kiosk runs;
-  everything else stays RPM-trust-only. (fapolicyd blocking that binary was the
-  original kiosk-won't-start cause.)
+  adjustment: the few non-RPM executables we ship are added to fapolicyd's trust DB
+  at build (provisioner 2c-STIG-postfix) so they run; everything else stays
+  RPM-trust-only. Trusted custom binaries: `/usr/local/bin/kiosk-session`,
+  `/usr/local/bin/fleet-sb-enroll`, `/usr/local/bin/fleet-hostapi` (the loopback
+  host-info agent, built from `files/hostapi`). Each is built into the immutable,
+  dm-verity-protected root, so trusting it doesn't weaken the overlay exec guard.
+  (fapolicyd blocking `kiosk-session` was the original kiosk-won't-start cause.)
 - **auditd** enabled; STIG audit rules applied; logs locally.
 - **USBGuard** enabled + enforcing (`block` target) with a HID/hub allowlist and
   `AuditBackend=LinuxAudit` (see #12) — blocks USB mass storage / unknown device