refactor: move tree under homelab/, add alma10 hardening and kickstart docs

- restructure boot/kickstarts/scripts/docs into homelab/
- docs: alma9->10 breaking changes, CIS hardening, kickstart changes
- add find_cron_entries.sh helper and codex running memory notes

Co-Authored-By: Claude Fable 5 <[email protected]>

homelab/kickstarts/alma10-auto.ks

@@ -0,0 +1,67 @@
+#version=RHEL10
+
+text
+eula --agreed
+lang en_US.UTF-8
+keyboard us
+timezone America/New_York --utc
+
+url --url="http://192.168.50.1/alma/10/BaseOS/x86_64/os"
+repo --name="appstream" --mirrorlist="https://mirrors.almalinux.org/mirrorlist/10.1/appstream" --proxy="http://192.168.50.1:3128"
+
+network --bootproto=dhcp --device=link --activate --hostname=alma10-auto
+
+rootpw --iscrypted $6$yTbTCLnnxjZOXGr9$92Dd9lUmINwEBtAWCOm9NZ12YTV0GZsoTRC3/RdkgGTSm888ezpAat5wKtlX/GBRMEr8dlSvvvqcWLk.il4yW/
+firewall --enabled --service=ssh
+selinux --enforcing
+services --enabled=sshd,chronyd
+firstboot --disable
+reboot
+
+zerombr
+clearpart --all --initlabel
+autopart --type=lvm
+
+bootloader --timeout=1
+
+%packages
+@^minimal-environment
+acl
+bash-completion
+bind-utils
+ca-certificates
+cloud-utils-growpart
+curl
+gcc
+git
+gnupg2
+jq
+lvm2
+make
+net-tools
+parted
+python3-pip
+ripgrep
+rsync
+sudo
+tmux
+tree
+unzip
+wget
+vim-enhanced
+zip
+%end
+
+%post --erroronfail --log=/root/ks-post.log
+set -euxo pipefail
+
+mkdir -p /root/pxe_boot_alma
+cat > /root/pxe_boot_alma/post-install-bootstrap.sh <<'EOF'
+#!/bin/bash
+set -euo pipefail
+bash <(curl -fsSL http://192.168.50.1/kickstarts/post-install-bootstrap.sh)
+EOF
+chmod 700 /root/pxe_boot_alma/post-install-bootstrap.sh
+
+/root/pxe_boot_alma/post-install-bootstrap.sh
+%end