Feature/aegis coreos (#7)

* feat(aegis): add ARM image bootstrap workflow

* feat(aegis): manage firewall and SSH hardening

* feat(aegis): harden Fedora IoT services

* chore(aegis): remove local TLS configuration

* fix(aegis): restore supported Fedora IoT bootstrap

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
 - Workstation: `deadalus` is Windows + Fedora WSL.
 - Ubuntu server: `prometheus`
 - NAS: `atlas` (Rocky Linux 9, reached through SSH)
-- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH)
+- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH)
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
@@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
-  - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
+  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
@@ -154,12 +154,18 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - If you add a new operational area, also add the narrowest validation command for it.
 - Call out checks you could not run and any follow-up verification needed.
 
-## Aegis Fedora CoreOS Notes
-- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with
+## Aegis Fedora IoT Notes
+- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
   `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
-- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
-- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, and the
-  Podman auto-update timer. Keep Apple IDs and other credentials in Vault and use `no_log` for their
-  rendering.
+- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
+- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
+  Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
+  key-authenticated users, never root or password authentication. Keep Apple IDs and other
+  credentials in Vault and use `no_log` for their rendering.
+- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
+  AdGuard binds port 53; keep
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
   persisted in `/var/lib/icloudpd/config`.