vilice harden

vilice harden — Optional OS / sshd hardening (first, before prepare)

Locks down the operating system: key-only SSH, a firewall holding open
sshd's port alone, and fail2ban. These scripts know nothing about
Vilice — no _vilice user, no record, no containers — so a box is
hardened whether or not it ever runs an app.

Hardening is deliberately separate from prepare, and optional. The
accountability floor never lives here, so an un-hardened box is still
an accountable one. Run it first on a fresh machine, or skip it and
bring your own hardening.

Usage:
  vilice harden [--check]

Flags:
  --check  Report drift instead of changing anything. A read: exits non-zero
           if the posture regressed, and is not recorded.

Examples:
  Lock the box down. Idempotent — re-running converges.
    sudo vilice harden

  Ask whether it is still locked down. Publishes the answer, so status and the
  console can show it.
    sudo vilice harden --check

Scope:  root — run on the box as root; never reachable over scoped SSH
Record: written before the command runs