feat: Add devopsos scaffold hardening — CIS/STIG/NSA/PSS/E8 infra hardening scaffold

[Copilot]

Adds a new devopsos scaffold hardening sub-command that generates production-ready infrastructure hardening configurations across Kubernetes, container runtimes, and OS targets from a single CLI entry point.

New: cli/scaffold_hardening.py

Core scaffold module (~600 lines) with generators for all ten standards:

Output type	Standards
Kyverno ClusterPolicy	CIS K8s v1.9 (5 section files), DISA STIG, NSA/CISA, Pod Security Standards, Cosign image signing
InSpec profiles	CIS Docker v1.6, CIS RHEL 9, CIS Ubuntu 22.04 (5 controls each)
Checkov custom checks	Essential Eight (ASD)
YAML	compliance-mapping.yaml — rules → framework control IDs (PCI-DSS, HIPAA, NIST 800-53, ISO27001)

Key behaviours:

• --environment production → Kyverno validationFailureAction: Enforce; dev/staging → Audit
• --type kyverno|inspec|checkov|all filters which artifact types are emitted
• Every Kyverno policy carries devops-os/compliance annotations for GovPilot catalog linking
• compliance-mapping.yaml maps each rule ID to framework control IDs consumed by check_selector.py

# CIS K8s policies, Enforce mode
devopsos scaffold hardening --standard cis-k8s --output hardening/

# All Kyverno policies, Audit mode for staging
devopsos scaffold hardening --standard all --type kyverno --environment staging

# RHEL 9 InSpec profile tagged for PCI-DSS
devopsos scaffold hardening --standard cis-rhel9 --type inspec --compliance-framework pci-dss

Modified: cli/devopsos.py

Imports scaffold_hardening and registers scaffold hardening as a Typer sub-command with all six options (--standard, --type, --output, --compliance-framework, --severity, --environment).

New: docs/devops-os-hardening-sprint.md

Sprint doc covering standards table, CLI design, generated file tree, 4-task implementation plan, testing plan, and effort estimate.

New: tests/test_hardening_scaffold.py

63 unit tests covering every generator, type-filter logic, environment→enforcement-action mapping, and file output correctness.