Run a heinzel security audit on a server — SSH hardening (password auth, weak algos, root login), firewall, user account hygiene, listening services, kernel hardening (ASLR, IP forwarding), file permissions, SUID/SGID audit, fail2ban. Use when the user asks for a "security audit", "security review", "hardening check", or to "audit security on <host>". Do NOT auto-invoke on generic phrases like "check server <host>". Covers Linux (Debian, Ubuntu, RHEL, CentOS, Fedora, SUSE) and macOS (SIP, FileVault, Gatekeeper).
