refactor: move tree under homelab/, add alma10 hardening and kickstart docs

- restructure boot/kickstarts/scripts/docs into homelab/
- docs: alma9->10 breaking changes, CIS hardening, kickstart changes
- add find_cron_entries.sh helper and codex running memory notes

Co-Authored-By: Claude Fable 5 <[email protected]>

codex-running-memory.md

@@ -0,0 +1,82 @@
+# Codex Running Memory
+
+## Goal
+
+Get the `probe` kickstart to a clean end state:
+
+- boots from installed disk
+- reachable by SSH
+- expected users exist
+- expected repos/packages and `cpanm` modules are installed
+- expected services/timers/scripts are configured
+- final proof run should preserve encrypted `/opt/iglass` if feasible
+
+## Process Rules
+
+- Read this file after any compaction before resuming work.
+- Update this file after meaningful harness or repo changes.
+- Use staged testing and isolate the first newly added failing script.
+- Prefer local LLM first for narrow triage, then Claude, then Codex when needed.
+
+## Current Test Model
+
+- Baseline scripts:
+  - `P200A-diskpart`
+  - `S110A-baseline-users-ssh`
+- Fixed probe MAC:
+  - `52:54:00:aa:bb:01`
+- Snapshot tests should only promote a template after:
+  - stage apply rc=0
+  - `Stage apply finished` logged
+  - expected new script present in `stage-applied-scripts.txt`
+  - reboot happened on a new `boot_id`
+  - SSH returned on that new boot
+
+## Important Harness State
+
+- Snapshot payloads now support:
+  - `cumulative` when rebuilding an older parent from baseline
+  - `delta` when parent template is the immediately previous verified stage
+- `probe_snapshot_stage.sh` now:
+  - uses a 5-minute boot window
+  - verifies reboot via changed `boot_id`
+- `restart_probe_watcher.sh` now retries stale snapshot apply and boot triage instead of idling forever
+
+## Verified Progress
+
+- Baseline verified good manually
+- Stage `1` verified good: `S000A-start`
+- Stage `2` verified good: `S104P-confluent`
+
+## Key Repo Fixes Already Made
+
+- `S105A-extra-pkgs`
+  - Alma 10 `@Xfce` guarded
+  - VMware SDK `cd`/`Makefile.PL` bug fixed
+- `S200A-systemctl`
+  - missing unit files no longer abort stage apply
+- `S350A-chrony`
+  - `timedatectl`, `chronyc`, and `hwclock` failures are best-effort in snapshot replay
+- `build_probe_stage_payload.sh`
+  - reconstructs `DISK` for snapshot replay
+- `S400P-noc-iglass`
+  - `/home` handling no longer hard-fails on non-empty directory
+  - AWS placeholder symlink lines corrected
+
+## Reset Point
+
+- Transient harness logs, attempt artifacts, state files, and flags are being cleared for the next run.
+- Next run should be treated as a fresh start from scratch.
+
+
+## Watcher State
+
+- Last updated: 2026-03-29 20:40:36
+- Current mode: snapshot-stage
+- Current stage: 7
+- Total staged scripts: 30
+- Baseline template: /var/lib/libvirt/images/probe-stage/probe-baseline-template.qcow2
+- Latest verified stage: none
+- Current suspect: S400P-noc-iglass
+- Current phase: triage-requested
+- Current detail: attempt=1 stage=7 suspect=S400P-noc-iglass outcome=snapshot stage failed rc=1