KESL 12.1.0-1297 image, Ubuntu 24.04 base, transparent UX

- Pinned download URL for KESL 12.1.0-1297 (public Kaspersky CDN, 2024-07).
- answer.txt updated to v12 autoinstall format: GROUP_CLEAN required,
  LOCALE=en_US.utf8 (en_US alone is rejected), INTERCEPTOR_MODE.
- start.sh detects v10 (/etc/init.d/kesl-supervisor) vs v12
  (/etc/init.d/kesl) and polls kesl-control until the daemon answers,
  because v12's first start runs an integrity check (~30s).
- Modes (shell/version/scan/debug) and scan output format unchanged so
  existing parsers keep working.
- README + build script point to tabledevil/kaspersky12.
- test_smoke.sh validates image + version + EICAR; auto-skips on macOS
  (Rosetta blocks the daemon).

Validated end-to-end on amd64 Linux:
  - 46 known-malicious files (LS26 detections) all flagged again
  - DetectSource=Local with --network=none + USE_KSN=No, no KSN calls

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

answer.txt

@@ -1,52 +1,24 @@
-# End User License Agreement flag must be 'yes' (required)"
-# See /opt/kaspersky/kesl/doc/license.<lang> for details
-EULA_AGREED=yes
+# KESL 12 autoinstall — offline on-demand scanner profile.
+# Required fields per support.kaspersky.com/kes-for-linux/12.3.0/197593
+EULA_AGREED=Yes
+PRIVACY_POLICY_AGREED=Yes
+USE_KSN=No
+GROUP_CLEAN=No
 
-# Privacy Policy agreement flag must be 'yes' (required)"
-# See /opt/kaspersky/kesl/doc/license.<lang> for details
-PRIVACY_POLICY_AGREED=yes
-
-# Use KSN: yes|no (required)
-# See /opt/kaspersky/kesl/doc/ksn_license.<lang> for details
-USE_KSN=no
-
-# Set up the service default locale
-#SERVICE_LOCALE=en_US.utf8
-SERVICE_LOCALE=C
-
-# Activation code or key file
-#INSTALL_LICENSE=
-
-# Set up updater source: KLServers|SCServer|<url>
+# Locale + updater source: pull fresh sigs from KLServers at build time.
+# LOCALE must be RFC 3066 with charset suffix (en_US alone is rejected).
+LOCALE=en_US.utf8
 UPDATER_SOURCE=KLServers
+PROXY_SERVER=None
 
-# Set up proxy server: none|<url>
-PROXY_SERVER=none
+# Bake databases into the image so the container is offline-capable.
+UPDATE_EXECUTE=Yes
 
-# Run the anti-virus database update procedure: yes|no
-UPDATE_EXECUTE=yes
+# No kernel module / no GUI / no SELinux — we run on-demand scans only.
+KERNEL_SRCS_INSTALL=No
+USE_GUI=No
+CONFIGURE_SELINUX=No
 
-# Download Linux kernel source automatically: yes|no
-KERNEL_SRCS_INSTALL=no
-
-# Import KESL10.0.0 settings after upgrade
-#IMPORT_SETTINGS=Yes
-
-# Set up product GUI: yes|no (required)
-USE_GUI=no
-
-
-
-
-#EULA_AGREED=yes
-#SERVICE_LOCALE=C
-#INSTALL_KEY_FILE=<path>
-#UPDATER_SOURCE=KLServers
-#UPDATER_PROXY=no
-#UPDATER_EXECUTE=yes
-#UPDATER_ENABLE_AUTO=no
-#RTP_BUILD_KERNEL_MODULE=no
-#RTP_BUILD_KERNEL_SRCS=auto
-#RTP_SAMBA_ENABLE=no
-#RTP_START=no
-#GUI_ENABLE=no
+# RTP is unused but keep fanotify default for sanity.
+INTERCEPTOR_MODE=UseFanotify
+INTERCEPTOR_FALLBACK_STRATEGY=FallbackToFanotify