feat(security): 新增 SSH network access 只讀清冊

scripts/security/high-value-config-control-coverage.py

@@ -131,14 +131,16 @@ CONTROL_STATUS_BY_CATEGORY = {
         "next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、restart window、rollback owner 與 post-check 指標。",
     },
     "ssh_firewall_network_access": {
-        "coverage_status": "policy_ready_needs_network_matrix",
-        "coverage_percent": 48,
+        "coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence",
+        "coverage_percent": 54,
         "evidence_refs": [
             "docs/HARD_RULES.md",
             "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
+            "docs/security/SSH-NETWORK-ACCESS-INVENTORY.md",
+            "docs/security/ssh-network-access-inventory.snapshot.json",
         ],
-        "current_gap": "尚未集中 ingress / egress、WireGuard、NodePort、firewall 與 known_hosts 矩陣。",
-        "next_owner_action": "補 target whitelist、host key policy、network owner、maintenance window 與 rollback owner。",
+        "current_gap": "repo-only 清冊已納入 16 個 SSH / network access surface；仍缺 live firewall / sudoers / known_hosts / NetworkPolicy / NodePort / WireGuard evidence、network owner 與 rollback owner。",
+        "next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。",
     },
     "ai_provider_model_routing": {
         "coverage_status": "policy_ready_needs_dry_run_pack",