fix(harden): keep hardening and the ntfy notifier alive when sshguard can't install

On a fresh AlmaLinux 9.8 box, install_bruteforce_protection ran unguarded under
'set -euo pipefail'. When sshguard (from EPEL) wasn't installable at that moment,
the single failed dnf aborted the ENTIRE harden run before it wrote sshd_config
or installed the pam_exec login notifier -- leaving a stock, unhardened box and a
silently-missing ntfy hook.

- oslib: install the iptables backend best-effort first, then sshguard, and
  return sshguard's status so callers can treat it as non-fatal.
- harden-ssh/harden-jumphost: install_openssh now dies with a clear message on
  failure; sshguard is '|| warn' so sshd hardening and the notifier still apply.
- install_login_notifier verifies the script + pam hook landed and logs
  'Login notifier ACTIVE' (or a loud warning) instead of failing silently.
- ntfy-ssh-login.sh: NTFY_DEBUG=1 logs delivery attempts + curl errors to
  /var/log/ssh-notify.log so the next silent failure leaves a trace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/harden-ssh.sh

@@ -64,7 +64,7 @@ log "Detected OS: ${OS_ID} (family ${OS_FAMILY}, init ${INIT_SYSTEM})"
 # ----------------------------------------------------------------------------
 if ! command -v ssh >/dev/null 2>&1; then
     log "ssh not found; installing openssh..."
-    install_openssh
+    install_openssh || die "Could not install OpenSSH; cannot harden. Fix the package error above, then re-run."
 fi
 
 log "Checking OpenSSH version supports PQ KEX..."
@@ -89,8 +89,12 @@ KEX_LIST=""
 # 2. Install packages (OS-gated inside oslib)
 # ----------------------------------------------------------------------------
 log "Installing OpenSSH server + sshguard + iptables..."
-install_openssh
-install_bruteforce_protection
+install_openssh || die "OpenSSH packages failed to install; cannot harden SSH. Fix the package error above, then re-run."
+# sshguard is best-effort: a host where it can't install right now (e.g. EPEL
+# momentarily unreachable) must still get the sshd_config hardening AND the login
+# notifier -- not a silently half-configured box. Warn and press on.
+install_bruteforce_protection \
+    || warn "sshguard not installed; brute-force protection is OFF. Add it later with: dnf install -y epel-release sshguard. Continuing with the rest of the hardening."
 
 # The external SFTP subsystem binary path differs per distro.
 SFTP_PATH="$(sftp_server_path)"