docs(security): add AppArmor, systemd sandboxing, Falco, YARA, cosign, OIDC, Ansible integration
Complete hardening workflow now covers all key technical concepts:
- AppArmor/SELinux status, systemd sandboxing audit
- Semgrep SAST, YARA malware patterns, Nuclei network scan
- Cosign artifact verification, SHA256 package verification
- Falco/eBPF runtime monitoring, Volatility 3 memory forensics
- OIDC/GAT token best practices
- Ansible integration per .clinerules/workstation.md
Co-authored-by: Junie <junie@jetbrains.com>
jaandJunie
ccdaf95f15