[hanthor]

Summary

• Provision an empty /var/home/tux/.hushlogin through the existing systemd-tmpfiles configuration.
• Suppress MOTD and other SSH login messages for the sandbox user without changing SSH authentication or masking failing services.
• Keep this change separate from the rootless Podman subordinate ID mappings.

Validation

• Ran systemd-sysusers and systemd-tmpfiles in a disposable filesystem and verified that an empty .hushlogin is created with mode 0644.
• Ownership changes to UID/GID 60000 could not be verified because the development container prohibits those chown operations.
• git diff --check passed.
• SSH behavior in a booted sandbox has not been verified.

The SSH client's known-host warning is unaffected, and any cloud-init service failure still requires separate diagnosis.