Add STIG hrdening

docs/design-v2-errata.md

@@ -78,6 +78,12 @@ These don't contradict the PDF (it doesn't specify them) but are worth recording
 - **Reference serving stack.** §7's SPDK + nginx + DHCP/DNS serving stack has a
   concrete docker-compose implementation in [../serving/](../serving/), incl.
   Docker image-volume mounting of the OCI artifact image.
+- **STIG hardening.** DISA STIG (SSG) is applied with a diskless/UKI/kiosk
+  tailoring; several rule families are deviated because the architecture makes
+  them N/A (no partitions, no GRUB, AIDE→dm-verity) or by lab decision (FIPS off,
+  firewall off, audit local-only). Full rationale + compensating controls:
+  [stig-deviations.md](stig-deviations.md). STIG kernel params live in the UKI
+  cmdline (the no-GRUB compensating control).
 - Assorted build-time fixes (HCL `%%{` escaping, file-provisioner staging,
   dracut module naming) are documented in
   [../CLAUDE.md](../CLAUDE.md) → "RHEL 9.x build notes".