STIG Capstone: Certify the Full Baseline

The proving ground. This host must pass a full DISA-STIG-style baseline before it can be accredited — unaided, across every control family you have practiced: SSH hardening, sensitive-file permissions, kernel/sysctl parameters, the authorized-use banner, account & password policy, and a restrictive umask. Every control starts non-compliant. Harden the box until all of them pass; the baseline only certifies when EVERY control is green, exactly like a SCAP scan gating an ATO. This is the evidence artifact a compliance reviewer asks for.