Tier-1: broker-adjacent post-provision in-DB STIG hardening component (SAFE + audit)

[wz-gsa]

Follow-on from the #557 design (Hybrid, tier 1). Implements the auto-applied in-database STIG hardening at provision — the safe/idempotent + audit-enable controls only. Destructive controls are the customer's (separate issue).

Scope (STIG-only, ~23 controls)

• Create + assign a dedicated ORA_STIG_PROFILE (NOT DEFAULT) with profile limits: SESSIONS_PER_USER (SV-270495), FAILED_LOGIN_ATTEMPTS 3 (270550), PASSWORD_LOCK_TIME UNLIMITED (270549), INACTIVE_ACCOUNT_TIME 35 (270551), PASSWORD_LIFE_TIME/GRACE (270563), resource limits (270496/270546).
• Exempt app service accounts from the profile via a broker input (avoid lockout/expiry of the tenant app).
• Enable mixed-mode unified-audit policies: ORA_SECURECONFIG, ORA_LOGON_FAILURES (SV-270501/270502/270504). Pure mode is unsupported on RDS SE2.
• Create the STIG password-verify function (SV-270561/270587) and attach to the profile.
• Default-account password handling (SV-270545).
• Verify-only (broker already sets via parameter group; do NOT set live): remote_os_roles, sql92_security, remote_login_passwordfile, audit_sys_operations, audit_trail, max_idle_time, _trace_files_public.

Mechanism + safety conditions (from #557 consensus)

• Runs as a broker-adjacent post-provision component that retrieves the master cred just-in-time (broker already holds it for param groups), connects over TLS, runs a fixed/parameterized SQL set (no tenant input), logs every statement per instance, drops the connection.
• A hardening failure MUST NOT brick provisioning — instance comes up; failure is observable/paged (fail-observable, not fail-closed-on-provision).
• Idempotent (ORA_STIG_PROFILE create handles pre-existing name; assignment skips exemption list).
• SQL source of truth = overlay hardening/sql/ (assess-first, fail-loud).
• Verified by the CINC/InSpec profile (overlay PR Flesh out concourse deployment. #10), set_by != verified_by.

Open design Qs

• Trigger: broker last_operation hook vs. a dedicated Concourse/one-shot job? Who owns the exemption-list input?
• Interaction with Oracle 19c: (optional future hardening) broker-managed per-binding least-privilege users #534 (per-binding least-priv users) and credential rotation.

Depends on #537 (Oracle plan), #558 (live proof to validate). Design: #557. Overlaps @pburkholder area (#545).