Good luck with the shutdown bug! A few things I'd check, since early power-offs on live systems are often not a crash:
- boot without "quiet" (and try "nomodeset") to see the last messages before it dies
- look for something calling poweroff: an ACPI power/lid event, low battery or thermal, or your own startup script exiting and taking the session with it
- if the journal is persistent, journalctl -b -1 shows the previous boot
For the locked start, NIP-49 makes it simple: store the key as an ncryptsec (scrypt + XChaCha20), ask for the password once at startup, keep the decrypted key only in memory and never write it to disk. On a live USB every reboot then locks it again for free.
