review: fix review findings (correctness, hardening, doc-accuracy)

First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

drivers/enforce-mcdc.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Shared Tier-1 MC/DC gate for every driver harness. Each driver's test/Makefile
+# invokes it as:
+#   bash ../../enforce-mcdc.sh <gcov.log> <build>/<name>.c.gcov <test.rc>
+# Fails unless every unit check passed AND <name>.c reached 100% MC/DC (condition)
+# coverage with no uncovered executable lines. The driver name is derived from the
+# .gcov filename so this one script serves all drivers (no per-driver copies to keep
+# in sync).
+#   $1 = gcov stdout log   $2 = <name>.c.gcov   $3 = test exit-code file
+set -uo pipefail
+LOG="$1"; GCOV="$2"; RCFILE="$3"
+base="$(basename "$GCOV")"; base="${base%.gcov}"   # e.g. freshness.c
+name="${base%.c}"                                   # e.g. freshness
+rc=0
+
+testrc="$(cat "$RCFILE" 2>/dev/null || echo 1)"
+if [ "$testrc" != "0" ]; then
+	echo "RESULT: unit checks FAILED (test exit $testrc)"; rc=1
+else
+	echo "RESULT: all unit checks passed"
+fi
+
+if [ ! -f "$GCOV" ]; then
+	echo "RESULT: no coverage file ($GCOV) produced"; exit 1
+fi
+
+notcov="$(grep -nE "condition[s]? .*not covered" "$GCOV" || true)"
+uncov_lines="$(grep -nE "^ +#####:" "$GCOV" || true)"
+
+# Summary lines for <name>.c from gcov stdout. Match the exact file so the test
+# harness translation unit (test_<name>.c, which also contains "<name>.c") is NOT
+# picked up.
+FMATCH="File '([^']*/)?${name}[.]c'"
+cond_line="$(awk -v patt="$FMATCH" '$0 ~ patt {f=1} f&&/Condition outcomes covered:/{print; f=0}' "$LOG")"
+line_line="$(awk -v patt="$FMATCH" '$0 ~ patt {f=1} f&&/Lines executed:/{print; f=0}' "$LOG")"
+echo "  ${line_line:-Lines executed: (n/a)}"
+echo "  ${cond_line:-Condition outcomes covered: (n/a)}"
+
+if [ -n "$notcov" ]; then
+	echo "RESULT: MC/DC gaps (conditions not covered):"
+	echo "$notcov" | sed 's/^/    /'
+	rc=1
+fi
+if [ -n "$uncov_lines" ]; then
+	echo "RESULT: uncovered executable lines in ${name}.c:"
+	echo "$uncov_lines" | sed 's/^/    /'
+	rc=1
+fi
+
+if ! echo "$cond_line" | grep -q "100.00%"; then
+	echo "RESULT: condition coverage is below 100%"
+	rc=1
+fi
+
+[ "$rc" = "0" ] && echo "RESULT: 100% MC/DC + all checks green ✓"
+exit "$rc"