review: iteration-1 fixes across CI, bridge, VM harness, and docs

CI/pipeline:
- KERNEL_TARBALL passed as a YAML env literal '~' was never tilde-expanded
  and would have failed every hosted kernel-build dispatch; the path is now
  exported from the shell. Verified reproducible before the fix.
- Every job gets timeout-minutes; boot smoke uses timeout -k so a wedged
  qemu is SIGKILLed instead of holding the job.
- Tarball fetch + fail-closed sha256 verification deduplicated into
  build/fetch-kernel-tarball.sh (with curl retries), used by build-kernel.sh
  and both CI jobs. busybox fetch gains retries too.
- ccache layer for kernel-build (cache keyed on defconfig+patches) recovers
  the incremental-compile speed the ephemeral-runner move cost.
- build-kernel.sh now asserts every fragment option survived olddefconfig —
  merge_config -m pastes text and Kconfig silently drops unmet symbols.

rs485-bridge:
- pending-buffer cap (2x max RTU ADU) instead of unbounded growth;
  explicit accept-loop error handling with backoff instead of .flatten();
  per-arm inline bounds instead of the string-keyed lookup whose default
  would have mis-bounded a future get-input; control-socket cleanup errors
  surfaced; flag-shaped values rejected in arg parsing; doc example uses a
  private mktemp dir. Test timing margins widened for contended runners
  (gap 25->120ms, 60x margin on the split-frame test).

VM harness:
- stage-1/stage-2 boot scripts share one validated slot parser and one
  by-name populator (qemu/rootfs/etc/warden-lib.sh) — the duplicated
  parser had already diverged on validation; userdata/oem mount failures
  now fail fast with a greppable sentinel; udhcpc fallback keys off the
  interface actually having an address; switch_root applet guarded.
- boot-smoke delegates the qemu invocation to run.sh (machine shape lives
  in ONE place); run.sh port 0 disables a hostfwd.
- mkimage: unknown partition names fail at build time; DISK_END is a max,
  not last-entry; --state keys validated as filenames.
- portal-scenario: mock readiness is asserted (no silent fall-through),
  hostfwd port collisions retried, mount-failure sentinel fails fast.
- ui-shot: fixed sleeps replaced with bounded screendump polling; the
  repaint assertion is real and documented as such. qmp.py loses its
  module-global and gains argv validation.

Docs/scrub: bench-host paths and the site AP name removed from six more
port docs and two evidence tables; path-bearing build artifacts (.elf,
.map) untracked (the 154-byte firmware .bin is path-free and stays);
ADR-0003 marked visibility-superseded by ADR-0007; stale section
cross-reference fixed; flare-edge noted as private for outside readers;
stale root-level review report removed per the new workspace rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

docs/architecture.md

@@ -65,7 +65,7 @@ supervisor logic runs in CI with no panel.
   the boot-mode register's survives-warm-reset / cleared-by-POR behaviour (the MaskRom
   recovery maneuver). The matching firmware-side `Bus` seam on flared's `devmem` — so
   the shipped ladder can be asserted to poke the confirmed offset, never the wrong-SoC
-  one — lands when flare-edge consumes warden-sdk (§7 item 3, maintainer-gated), not yet on
+  one — lands when flare-edge consumes warden-sdk (§8 item 3, maintainer-gated), not yet on
   flare-edge `main`.
 - **`modbus` — RS-485 device end.** Done. `ModbusSlave`: a byte-in/byte-out RTU slave
   (CRC16 byte-identical to the master, FC 0x01–0x06/0x0F/0x10/0x11, exception replies,

docs/ci-cd.md

@@ -2,8 +2,8 @@
 
 `.github/workflows/ci.yml` — every job runs on GitHub-hosted `ubuntu-latest`.
 No self-hosted runner is (or may be) reachable from this repo's workflows:
-the repo is public, and a fork PR that gets one approved run could otherwise
-execute code on private infrastructure (ADR-0007).
+the repo is going public, and a fork PR that gets one approved run could
+otherwise execute code on private infrastructure (ADR-0007).
 
 ## Jobs
 

docs/decisions/0003-standalone-repo.md

@@ -1,6 +1,8 @@
 # ADR 0003 — warden-sdk is a standalone repo
 
-**Status:** Accepted (2026-08-25).
+**Status:** Accepted (2026-08-25). Repo-visibility half superseded by ADR-0007
+(2026-08-30) — warden-sdk went public; the "private for now" consequence below
+no longer holds. Original decision kept for the record.
 
 ## Context
 Our real SDK changes lived as uncommitted edits in a 2GB opaque vendor fork, with
@@ -10,7 +12,7 @@ no CI, tests, or versioning of their own. The SDK requirement (future-features-2
 ## Decision
 A **private** `bfe-noah/warden-sdk` GitHub repo, standalone from day one with its own
 CI/versioning. Work lands on a `bringup` branch; the first commit to `main` is gated
-on a passing code-review-harness run, green CI, and the maintainer's fresh explicit go-ahead.
+on a passing review run, green CI, and the maintainer's fresh explicit go-ahead.
 
 ## Consequences
 - flare-edge consumes warden-sdk later (flared depending on `warden-sim`, drivers