Hardening baselines

CIS-aligned and custom hardening checks, evaluated read-only on the host with a compliance heartbeat