docs(wiki): firmware/dbx-vs-TPM hardening + create disk-os-hardening page

Real-world park-buzi episode: a UEFI dbx update (delivered via fwupd/LVFS,
NOT apt) revoked a stale GRUB -> panic, and moved PCR 7 -> broke TPM-sealed
LUKS auto-unlock -> passphrase prompt. Recovered by re-sealing PCR 7.

- appliance-provisioning.md: extend the §4 re-seal runbook to name dbx; new
  §4a (fwupd-not-apt, GRUB-panic ordering, PCR-7 re-seal, operator lockdown:
  mask fwupd + remove firmware-updater snap + BIOS-password + passphrase
  escrow) incl. the --test-passphrase-silently-passes-via-TPM trap
  (--disable-external-tokens); gotchas #12/#13.
- disk-os-hardening.md: NEW — resolves a long-dangling wikilink referenced
  from ~18 pages. The *why* of host hardening (5 controls + firmware lockdown);
  commands stay in appliance-provisioning; reconciliation remains the primary
  anti-fraud control.
- index.md: expand the disk-os-hardening catalog line.
- log.md: two note entries.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1993,3 +1993,38 @@ the in-container path as the UI target. Acknowledged limitation: backups are NOT
 plug-a-USB-and-go); adding a destination is an admin host+compose change. Partly a feature vs the
 operator-adversary threat model (operator can't redirect backups to a removable stick). USB-automount-to-
 container flow deferred/not built.
+
+## [2026-06-30] note | UEFI dbx / firmware update vs TPM-sealed LUKS — GRUB panic + PCR-7 re-seal + operator lockdown (park-buzi)
+
+Real-world on park-buzi. The GNOME "Firmware Updater" (Ubuntu = the `firmware-updater` snap) surfaced a
+pending UEFI dbx (Secure Boot revocation DB) update, vendor Microsoft, delivered by fwupd/LVFS — a channel
+SEPARATE from APT (apt list --upgradable was clean except 2 cups packages). 2026-06-28 a dbx update against a
+stale GRUB revoked the bootloader → GRUB panic / unbootable → user reinstalled Ubuntu 26.04 LTS (resolute) to
+recover (fresh install ships a current GRUB). Correct order is `apt full-upgrade` (current grub-efi/shim-signed)
+FIRST, then dbx.
+
+Even with a current GRUB, applying dbx moves PCR 7 (Secure-Boot-policy measurement) → the TPM (slot 1) refuses
+to release the LUKS key → next boot drops to the slot-0 passphrase prompt. VERIFIED end-to-end: proved the
+slot-0 typed passphrase first, applied dbx, rebooted to a passphrase prompt, unlocked with slot 0, re-enrolled
+`systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/sda3` → silent auto-unlock restored.
+
+Gotcha: `cryptsetup open --test-passphrase /dev/sda3` SILENTLY passes via the TPM token (auto-unlocks the tpm2
+slot without prompting) — a false safety signal. Force a real typed-passphrase test with
+`--disable-external-tokens` (→ "No usable token is available." then prompts; success on slot 0 proves it).
+
+Threat-model lockdown (operator is the adversary): a firmware/dbx update makes the booth need the passphrase to
+boot unattended, so operators must not be able to trigger one and must never hold the passphrase. Applied on
+park-buzi: `systemctl mask fwupd.service fwupd-refresh.timer` (→ masked/masked, persists), `snap remove
+firmware-updater` (remove the GUI; re-check, seeded snaps can re-install), BIOS admin password gates setup
+entry, slot-0 passphrase stays escrowed off-machine. Firmware updates are now admin-only/on-site/deliberate.
+Recorded in appliance-provisioning.md §4 re-seal runbook + new §4a + gotchas #12/#13.
+
+## [2026-06-30] note | Created disk-os-hardening.md (resolved a long-standing orphan)
+
+`[[disk-os-hardening]]` was referenced from ~18 pages (overview, threat-model, tpm, fleet-deployment,
+appliance-provisioning, backup-recovery, index, …) but never written — a dangling wikilink. Wrote it as
+the *rationale* page (the why): the five host controls (LUKS FDE, TPM-sealed PCR-7 auto-unlock, Secure
+Boot Deployed, GRUB edit-lock, unprivileged-operator) + the firmware/dbx lockdown (§4a cross-ref), each
+with its load-bearing nuance, plus the standing caveat that this is the SECONDARY control —
+reconciliation over the signed chain is the main anti-fraud event. Commands stay in appliance-provisioning
+(the how); this page points there. Updated the index.md line accordingly.