security-privacy-checklisted

Run `scripts/security-privacy-check.sh` from the repo root and show its output as-is. It's report-only and side-effect-free — never installs anything, changes a setting, or revokes a permission. Every run also writes a timestamped copy of its full output to `.claude/security-reports/` (gitignored — machine state, not project narrative, same reasoning as `.claude/audit/`). The script prints the exact path at the end; mention it so the user knows where to find it for comparison against a later run. Two independent halves: 1. **Lynis** — a layered package (see `scripts/PACKAGES.md`), reused rather than hand-rolled per CLAUDE.md's prior-art rule. Covers general OS hardening: boot/kernel, SELinux, SSH, cron, file integrity. If `rpm -q lynis` reports it missing, point at `rpm-ostree install lynis` (from `scripts/layer-packages.sh`) rather than improvising the install command. Needs root, via `pkexec` (not `sudo` — the script has no TTY to prompt against when run non-interactively, and `pkexec` is CLAUDE.md's rule for root commands anyway). Expect the GNOME polkit dialog to appear on screen. **Its boot/filesystem checks assume a traditional (non-ostree) layout** — findings there can be an artifact of the image-based root, not a real issue. Read Lynis's own findings before treating any of them as actionable, and say so if one looks ostree-specific rather than proposing a fix for it. Known false positive: **AUTH-9216 / `grpck` "no matching gro