review: fix review findings (correctness, hardening, doc-accuracy)

First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

README.md

@@ -11,11 +11,13 @@ RV1106 HMI). A from-scratch replacement for the twice-ported vendor stack
 the rest of the firmware: tested, benchmarked, reproducible, and honest about
 what runs on real silicon versus what we simulate.
 
-> Status: **bootstrapping.** This repo is being stood up incrementally; today it
-> hosts the hardware **simulator** and its tests. The kernel forward-port and the
-> hermetic image build move in as each is proven. Until then, flare-edge still
-> builds firmware from the vendored SDK + `sdk-patches/`; nothing here is on the
-> production build path yet.
+> Status: **bringup.** The hardware **simulator** and its tests, the RV1106 kernel
+> forward-port as a reviewable `patches/` series, the hermetic kernel build, and two
+> Tier-1 drivers at 100% MC/DC are all in and CI-green on the `bringup` branch. What
+> remains before this is on the production build path: installing the self-hosted
+> kernel-build runner (see `docs/ci-cd.md`) and having flare-edge consume warden-sdk
+> as a dependency — both [maintainer]-gated. Until then, flare-edge still builds firmware from
+> the vendored SDK + `sdk-patches/`.
 
 ## Why a new SDK
 
@@ -87,13 +89,15 @@ than duplicate each other.
 ## Layout
 
 ```
-sim/        the hardware simulator (Rust): mailbox/devmem model, HPMCU, RGA, NPU.
-drivers/    our own hardened drivers + their seams (as they migrate in).
-patches/    the vendor-SDK delta (mirrors flare-edge/sdk-patches until it moves here).
-build/      the hermetic image-build wrapper (kernel → rootfs → image), incremental.
-ci/         CI: patches-still-apply, host tests, coverage, benchmarks.
-docs/       architecture + ADRs (decisions/).
-tools/      dev tooling. config-lint: static target-config gates (MCU-load-vs-reserved-memory — the 0x40000 brick class).
+sim/        the hardware simulator (Rust): membus/devmem, HPMCU, CRU, Modbus, RGA, NPU.
+drivers/    our own hardened drivers + their seams (relays, freshness; more migrate in).
+patches/    the RV1106 kernel forward-port delta onto pristine linux-6.18.46 (subsystem-split).
+kernel/     forward-port docs + provenance (rv1106-enablement/, PROVENANCE.md).
+build/      the hermetic kernel build (fetch pristine → apply patches → zImage + dtb).
+docs/       architecture + ADRs (decisions/) + ci-cd + generated workflow flowcharts.
+tools/      dev tooling. config-lint: static target-config gates (MCU-load-vs-reserved-memory,
+            the 0x40000 brick class); flowgen: the workflow-flowchart generator.
+.github/    CI (workflows/ci.yml): patches-apply, host tests, coverage, MC/DC, benchmarks, badges.
 ```
 
 ## Principles