[IXI-2773]

Scope

• Add one reproducible synthetic case using the unmodified, attributed third-party Linux CIS Bash auditor.
• Before/after fake SSH/PAM/login.defs trees, read-only section-5 runner, normalized JSON evidence, analysis and original author/license links.
• Update first-party and third-party catalogs so the one executed community example is distinguished from six still source-only imports.
• No network/real host scan, secrets, or live remediation.

Actual focused execution

python3 case_lab_temp/case/verify_lab.py --tool case_lab_temp/upstream/src/cisaudit.sh returned exit 0 after invoking the imported Bash scanner against both fixtures.

• 23 section-5 controls. Before: 2 PASS / 18 FAIL / 3 SKIP (10% scored). After: 19 PASS / 1 FAIL / 3 SKIP (95% scored).
• 17 FAIL→PASS transitions; unresolved cron 5.1.1 and 3 skipped cron permission checks.
• Full normalized JSON is committed; only hostname and timestamp removed. All 17 imported Bash files used matched fetched Git blob SHAs at source base revision 4ac88d5912d4ab87c780f0d466e53c8ad5e139f0.

Boundaries

This is a scanner response to fabricated text files, not full CIS compliance or a validated production fix. SSH key/file permissions cannot be established in test mode. No full test suite invoked.