drivers/relays: hardened + 100% MC/DC (Tier-1, first driver)

Bring relays.c into warden-sdk/drivers/ behind a relay_io seam (ADR-0005): the
sysfs plumbing is an injectable backend, the gpio root is $WARDEN_GPIO_ROOT-
overridable. Host harness (drivers/relays/test/) reaches 100% MC/DC (40/40
conditions, 100% lines) by combining fake-io unit tests (logic branches incl.
export->node-appears) with real-sysfs integration tests over a scratch tree
(backend fopen/stat branches). CI `mcdc` job enforces 100% across drivers/*/test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

drivers/relays/test/Makefile

@@ -0,0 +1,41 @@
+# MC/DC unit harness for drivers/relays/relays.c.
+#
+#   make check   — build, run, and FAIL unless relays.c hits 100% MC/DC
+#                  (condition) coverage and every unit check passes.
+#   make report  — per-condition gcov annotation (build/relays.c.gcov).
+#   make clean
+#
+# Requires gcc >= 14 (for -fcondition-coverage) and its matching gcov.
+CC      ?= gcc
+GCOV    ?= gcov
+CFLAGS  := -O0 -g -Wall -Wextra -I..
+COVFLAGS := --coverage -fcondition-coverage
+BUILD   := build
+
+.PHONY: check report clean
+.DEFAULT_GOAL := check
+
+$(BUILD):
+	@mkdir -p $(BUILD)
+
+# relays.c carries the coverage flags; the test driver is plain.
+$(BUILD)/test: test_relays.c ../relays.c ../relays.h | $(BUILD)
+	@$(CC) $(CFLAGS) $(COVFLAGS) -c ../relays.c -o $(BUILD)/relays.o
+	@$(CC) $(CFLAGS) -c test_relays.c -o $(BUILD)/test_relays.o
+	@$(CC) $(COVFLAGS) $(BUILD)/relays.o $(BUILD)/test_relays.o -o $(BUILD)/test
+
+check: $(BUILD)/test
+	@echo "== running relays MC/DC harness =="
+	@rm -f $(BUILD)/relays.gcda
+	@$(BUILD)/test; echo $$? > $(BUILD)/test.rc
+	@echo
+	@echo "== MC/DC (condition) coverage of relays.c =="
+	@$(GCOV) --conditions --branch-probabilities -o $(BUILD) ../relays.c >$(BUILD)/gcov.log 2>&1 || true
+	@mv -f *.gcov $(BUILD)/ 2>/dev/null || true
+	@bash enforce-mcdc.sh $(BUILD)/gcov.log $(BUILD)/relays.c.gcov $(BUILD)/test.rc
+
+report: check
+	@grep -nE "condition.*not covered|conditions covered" $(BUILD)/relays.c.gcov || true
+
+clean:
+	@rm -rf $(BUILD)