## What

<!-- What changes does this PR introduce? -->

## Why

<!-- Why is this needed? Reference any issue or motivation. -->

## Test plan

- [ ] `ksvalidator kickstart/veilor-os.ks` passes
- [ ] Shellcheck clean on edited scripts
- [ ] Local ISO build succeeds OR CI build green
- [ ] Booted ISO in QEMU via `./test/run-vm.sh` and walked `test/boot-checklist.md`
- [ ] No personal/onyx leaks (`grep -ri 'onyx\|192\.168\.0\.\|fedora\.local'` returns zero)

## Hardening impact

<!-- Does this PR add/remove a hardening control? Update docs/HARDENING.md
     if so. -->