phase 2 done. we built a custom linux distro from scratch for agenc one. killed raspberry pi os. no desktop. no package manager. no ssh. no bloat. just the agent: power on > 3 seconds > live read-only root. encrypted keys on hardware. secure boot. OTA with automatic rollback. full image under 250MB. factory provisioning so every unit ships the same 11 issues. all closed. phase 3 next ...