Enable the encrypted install, and answer the audit's open absences
Containerfile: multi-stage cargo builds; first-boot Flatpak; boot fixes