review: iteration-1 fixes across CI, bridge, VM harness, and docs

CI/pipeline:
- KERNEL_TARBALL passed as a YAML env literal '~' was never tilde-expanded
  and would have failed every hosted kernel-build dispatch; the path is now
  exported from the shell. Verified reproducible before the fix.
- Every job gets timeout-minutes; boot smoke uses timeout -k so a wedged
  qemu is SIGKILLed instead of holding the job.
- Tarball fetch + fail-closed sha256 verification deduplicated into
  build/fetch-kernel-tarball.sh (with curl retries), used by build-kernel.sh
  and both CI jobs. busybox fetch gains retries too.
- ccache layer for kernel-build (cache keyed on defconfig+patches) recovers
  the incremental-compile speed the ephemeral-runner move cost.
- build-kernel.sh now asserts every fragment option survived olddefconfig —
  merge_config -m pastes text and Kconfig silently drops unmet symbols.

rs485-bridge:
- pending-buffer cap (2x max RTU ADU) instead of unbounded growth;
  explicit accept-loop error handling with backoff instead of .flatten();
  per-arm inline bounds instead of the string-keyed lookup whose default
  would have mis-bounded a future get-input; control-socket cleanup errors
  surfaced; flag-shaped values rejected in arg parsing; doc example uses a
  private mktemp dir. Test timing margins widened for contended runners
  (gap 25->120ms, 60x margin on the split-frame test).

VM harness:
- stage-1/stage-2 boot scripts share one validated slot parser and one
  by-name populator (qemu/rootfs/etc/warden-lib.sh) — the duplicated
  parser had already diverged on validation; userdata/oem mount failures
  now fail fast with a greppable sentinel; udhcpc fallback keys off the
  interface actually having an address; switch_root applet guarded.
- boot-smoke delegates the qemu invocation to run.sh (machine shape lives
  in ONE place); run.sh port 0 disables a hostfwd.
- mkimage: unknown partition names fail at build time; DISK_END is a max,
  not last-entry; --state keys validated as filenames.
- portal-scenario: mock readiness is asserted (no silent fall-through),
  hostfwd port collisions retried, mount-failure sentinel fails fast.
- ui-shot: fixed sleeps replaced with bounded screendump polling; the
  repaint assertion is real and documented as such. qmp.py loses its
  module-global and gains argv validation.

Docs/scrub: bench-host paths and the site AP name removed from six more
port docs and two evidence tables; path-bearing build artifacts (.elf,
.map) untracked (the 154-byte firmware .bin is path-free and stays);
ADR-0003 marked visibility-superseded by ADR-0007; stale section
cross-reference fixed; flare-edge noted as private for outside readers;
stale root-level review report removed per the new workspace rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/sbin/init

@@ -13,33 +13,29 @@ mount -t proc proc /proc
 mount -t sysfs sysfs /sys
 mount -t tmpfs tmpfs /tmp
 
-# Fresh devtmpfs — repopulate the by-name contract (slotctl.rs depends on it).
-mkdir -p /dev/block/by-name
-for uev in /sys/class/block/vda*/uevent; do
-    [ -f "$uev" ] || continue
-    partname=""
-    devname=""
-    while IFS='=' read -r k v; do
-        case "$k" in
-            PARTNAME) partname="$v" ;;
-            DEVNAME)  devname="$v" ;;
-        esac
-    done < "$uev"
-    [ -n "$partname" ] && [ -n "$devname" ] \
-        && ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
-done
+. /etc/warden-lib.sh
 
-# Slot (whole-token parse, same rule as stage 1).
-slot="_a"
-for tok in $(cat /proc/cmdline); do
-    case "$tok" in
-        warden.slot=*) slot="${tok#warden.slot=}" ;;
-    esac
-done
+# Fresh devtmpfs — repopulate the by-name contract; same VALIDATED slot rule
+# as stage 1 (shared helper, so the two can never drift).
+warden_populate_by_name
+slot="$(warden_slot)"
 
 # The device's matched mounts: persistent state and the slot's oem partition.
-mount -t ext4 /dev/block/by-name/userdata /userdata || echo "init: userdata mount failed"
-mount -t ext4 "/dev/block/by-name/oem${slot}" /oem || echo "init: oem${slot} mount failed"
+# Fail-fast: a scenario against an image whose userdata cannot mount would
+# otherwise burn its whole deadline before failing generically. warden.shell
+# still gets a shell for post-mortem.
+mount_fatal() {
+    if ! mount -t ext4 "/dev/block/by-name/$1" "$2"; then
+        echo "WARDEN-QEMU-MOUNT-FAILED $1"
+        if grep -qw warden.shell /proc/cmdline; then
+            echo "warden.shell: post-mortem shell (exit powers off)"
+            setsid cttyhack sh
+        fi
+        poweroff -f
+    fi
+}
+mount_fatal userdata /userdata
+mount_fatal "oem${slot}" /oem
 mkdir -p /userdata/warden
 
 # RS485: warden-modbus hardcodes /dev/ttyS4 at compile time; alias it to the
@@ -47,10 +43,13 @@ mkdir -p /userdata/warden
 [ -c /dev/ttyS0 ] && ln -sf /dev/ttyS0 /dev/ttyS4
 
 # Network: slirp user-mode net on eth0 (DHCP, fallback to QEMU's static map).
+# The fallback keys off the interface actually having an address — udhcpc
+# exiting 0 only proves a lease, not that the hook script applied it.
 ip link set lo up
 if [ -e /sys/class/net/eth0 ]; then
     ip link set eth0 up
-    if ! udhcpc -i eth0 -n -q -t 5 -T 2 >/dev/null 2>&1; then
+    udhcpc -i eth0 -n -q -t 5 -T 2 >/dev/null 2>&1 || true
+    if ! ip -4 addr show dev eth0 | grep -q 'inet '; then
         ip addr add 10.0.2.15/24 dev eth0 2>/dev/null
         ip route replace default via 10.0.2.2 dev eth0
         echo "nameserver 10.0.2.3" > /etc/resolv.conf