Triage Linux boxes, apply distro mitigations, and harden nodes, CI runners, and container hosts before a local foothold turns into root.