Runbook: SFTP Only Chroot Model
Focus: SFTP-only Zugänge und Chroot-Anforderungen

1. Run ./run.sh.
2. Inspect work/evidence/.
3. Review fingerprints, effective client config and policy-check output.
4. Remove work/ after collecting evidence.
