fix(harden): keep hardening and the ntfy notifier alive when sshguard can't install

On a fresh AlmaLinux 9.8 box, install_bruteforce_protection ran unguarded under
'set -euo pipefail'. When sshguard (from EPEL) wasn't installable at that moment,
the single failed dnf aborted the ENTIRE harden run before it wrote sshd_config
or installed the pam_exec login notifier -- leaving a stock, unhardened box and a
silently-missing ntfy hook.

- oslib: install the iptables backend best-effort first, then sshguard, and
  return sshguard's status so callers can treat it as non-fatal.
- harden-ssh/harden-jumphost: install_openssh now dies with a clear message on
  failure; sshguard is '|| warn' so sshd hardening and the notifier still apply.
- install_login_notifier verifies the script + pam hook landed and logs
  'Login notifier ACTIVE' (or a loud warning) instead of failing silently.
- ntfy-ssh-login.sh: NTFY_DEBUG=1 logs delivery attempts + curl errors to
  /var/log/ssh-notify.log so the next silent failure leaves a trace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/ntfy-ssh-login.sh

@@ -123,5 +123,20 @@ tags="warning"
 [ -n "${NTFY_REGION:-}" ] && tags="${tags},${NTFY_REGION}"
 set -- "$@" -H "X-Tags: ${tags}"
 
-curl "$@" -d "$body" "$NTFY_URL" >/dev/null 2>&1 || true
+# Deliver. Failures are non-fatal -- a login must never be blocked by a notifier
+# hiccup. Set NTFY_DEBUG=1 in the conf to log attempts + curl errors to
+# /var/log/ssh-notify.log, so a silent failure (SELinux, egress, bad token, ...)
+# leaves a trace instead of vanishing.
+if [ "${NTFY_DEBUG:-0}" = "1" ]; then
+    log=/var/log/ssh-notify.log
+    printf '%s login user=%s rhost=%s -> %s\n' \
+        "$(date -u +%FT%TZ 2>/dev/null || echo)" "$user" "$rhost" "$NTFY_URL" >> "$log" 2>/dev/null || true
+    if curl "$@" -d "$body" "$NTFY_URL" >>"$log" 2>&1; then
+        echo "  -> delivered" >> "$log" 2>/dev/null || true
+    else
+        echo "  -> curl FAILED (exit $?)" >> "$log" 2>/dev/null || true
+    fi
+else
+    curl "$@" -d "$body" "$NTFY_URL" >/dev/null 2>&1 || true
+fi
 exit 0