review: fix review findings (correctness, hardening, doc-accuracy)

First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

sim/src/hpmcu.rs

@@ -92,7 +92,8 @@ impl<B: MemBus> HpmcuSim<B> {
             return;
         }
         self.polls = self.polls.wrapping_add(1);
-        self.bus.poke32(self.base + OFF_CYC, (now & 0xffff_ffff) as u32);
+        self.bus
+            .poke32(self.base + OFF_CYC, (now & 0xffff_ffff) as u32);
         let magic = self.bus.peek32(self.base + OFF_MAGIC);
         let counter = self.bus.peek32(self.base + OFF_COUNTER);
         let poll_lo = self.polls & 0xffff;
@@ -100,7 +101,8 @@ impl<B: MemBus> HpmcuSim<B> {
         if magic == MAGIC_DISARM {
             // Deliberate stand-down: resume the moment Linux re-arms; the grace
             // clock restarts so a disarm-then-silence never fires.
-            self.bus.poke32(self.base + OFF_STATE, STATE_DISARMED | poll_lo);
+            self.bus
+                .poke32(self.base + OFF_STATE, STATE_DISARMED | poll_lo);
             self.t0 = now;
             self.last_change = now;
         } else if magic == MAGIC_ARMED {
@@ -110,7 +112,8 @@ impl<B: MemBus> HpmcuSim<B> {
                 self.bus.poke32(self.base + OFF_SEEN, counter);
                 self.last_change = now;
             }
-            self.bus.poke32(self.base + OFF_STATE, STATE_ARMED | poll_lo);
+            self.bus
+                .poke32(self.base + OFF_STATE, STATE_ARMED | poll_lo);
             if now.saturating_sub(self.last_change) > HEARTBEAT_TIMEOUT_S {
                 self.fire();
             }
@@ -186,7 +189,10 @@ mod tests {
         // Heartbeat stops (counter frozen). Fires just past 90s.
         for now in (5..=90).step_by(5) {
             m.tick(now);
-            assert!(!m.fired(), "must not fire within the heartbeat window (@{now}s)");
+            assert!(
+                !m.fired(),
+                "must not fire within the heartbeat window (@{now}s)"
+            );
         }
         m.tick(91);
         assert!(m.fired(), "must fire just past the 90s heartbeat timeout");
@@ -225,7 +231,10 @@ mod tests {
             counter += 1;
             arm_beat(&bus, counter);
             m.tick(now);
-            assert!(!m.fired(), "flared armed before boot-grace: must never fire (@{now}s)");
+            assert!(
+                !m.fired(),
+                "flared armed before boot-grace: must never fire (@{now}s)"
+            );
         }
         assert_eq!(m.state(), STATE_ARMED);
     }
@@ -252,6 +261,9 @@ mod tests {
             assert!(!m.fired(), "within the heartbeat window (@{now}s)");
         }
         m.tick(695); // 695 - 600 = 95 > 90
-        assert!(m.fired(), "flared dead > heartbeat timeout: MCU fires the reset");
+        assert!(
+            m.fired(),
+            "flared dead > heartbeat timeout: MCU fires the reset"
+        );
     }
 }