Say what the security manual's defaults actually are

Problem

manual/48-security.md:5-6 makes two promises the defaults don't keep:

• "Full-disk encryption is mandatory". The installer offers "Yes, install without encryption", and manual/02-getting-started.md:35 documents the Ctrl+C opt-out. On such an install, Reset is deletion rather than an erase, and autologin is limited to the first boot.
• "All incoming traffic is blocked by default except for port 53317". The firewall also admits UDP 53 from the Docker ranges to 172.17.0.1 (install/config/firewall.sh:10-11). UFW's stock before.rules accepts multicast DNS on 5353, which avahi-daemon (enabled at install/config/enable-services.sh:4) answers. That announces the machine's hostname on the LAN.

People reading this chapter decide on that basis, for example whether a lost laptop is a problem.

Change

Item 1 says encryption is on by default, with an opt-out for throw-away machines that carries none of the protection. Item 2 names the three exceptions: LocalSend, Docker DNS, and mDNS. Translations are left to the catalog sync.

Notes

• Same text in 4.0.6.
• Duplicate check: encryption is mandatory, without encryption, unencrypted install, avahi, mdns, LocalSend firewall. #11560 (LocalSend open to Anywhere, including IPv6) is related but separate.

Found while testing Omarchy 4.5.0-rc1.