Add STIG hrdening

CLAUDE.md

@@ -152,6 +152,15 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
+- STIG remediation: (a) verify the SSG datastream name on the target distro
+  (`ssg-rhel9-ds.xml` vs `ssg-rl9-ds.xml` — the provisioner tries both) and that
+  the `...content_profile_stig` profile id exists; (b) remediation must not break
+  boot/login (NM/NVMe, key-only sshd, kiosk, SELinux enforcing) — `enable_stig=false`
+  is the escape hatch; (c) **reproducibility**: build twice and confirm identical
+  `root_hash` in verity.json — if it drifts, oscap wrote something
+  nondeterministic (timestamp/uuid/key); find + normalize it in 2d hygiene;
+  (d) read the generated `stig-deviations.md` — every REVIEW row is a real finding
+  to triage or justify in `docs/stig-deviations.md`.
 - NTP via DHCP option 42 → chrony (no public-pool egress): confirm on a booted
   host `chronyc sources` lists the DHCP-handed lab server (not `*.pool.ntp.org`).
   Assumes (a) NM exports the lease's NTP servers to the dispatcher as
@@ -212,6 +221,19 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress.
   stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving
   stack lives in `serving/` (docker compose). Re-enable security by dropping the
   var / setting `DISABLE_DOT1X: "false"` in the CI workflow.
+- **STIG toggle**: `enable_stig=true` (default) applies DISA STIG via
+  OpenSCAP/SSG in a provisioner, tailored for the diskless/UKI/kiosk architecture
+  (`files/stig/diskless-tailoring.xml` unselects the N/A or
+  dangerous-to-remediate rules; every waiver is justified in
+  `docs/stig-deviations.md`). STIG kernel params ride the **UKI cmdline**
+  (`extract-artifacts.sh`, gated by the same flag) since there's no GRUB.
+  **FIPS is OFF and audit offload is LOCAL-only** (decisions). CI is
+  **report-only**: it publishes `stig-report.html` + `stig-arf.xml` +
+  `stig-deviations.md` (generated by `scripts/stig-deviations.sh`) as artifacts
+  and never fails on score. The scanner tooling is removed from the shipped image
+  (2d hygiene). `enable_stig=false` is the escape hatch if hardening regresses
+  the boot/secure-path bench. NEVER let a waiver hide a real finding — anything
+  non-pass that isn't in the register shows as **REVIEW** in the report.
 - **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for the
   Plymouth splash; `false` bakes `plymouth.enable=0` for a verbose console boot —
   keep OFF while debugging the boot chain. Plymouth is always in the image +