review: fix review findings (correctness, hardening, doc-accuracy)

First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

sim/src/modbus.rs

@@ -28,7 +28,11 @@ pub fn crc16(bytes: &[u8]) -> u16 {
     for &b in bytes {
         crc ^= b as u16;
         for _ in 0..8 {
-            crc = if crc & 1 != 0 { (crc >> 1) ^ 0xA001 } else { crc >> 1 };
+            crc = if crc & 1 != 0 {
+                (crc >> 1) ^ 0xA001
+            } else {
+                crc >> 1
+            };
         }
     }
     crc
@@ -202,7 +206,11 @@ impl ModbusSlave {
         if count == 0 || count > 2000 {
             return Err(exc::ILLEGAL_DATA_VALUE);
         }
-        let bank = if discrete { &self.discrete } else { &self.coils };
+        let bank = if discrete {
+            &self.discrete
+        } else {
+            &self.coils
+        };
         if start + count > bank.len() {
             return Err(exc::ILLEGAL_DATA_ADDRESS);
         }
@@ -272,7 +280,10 @@ impl ModbusSlave {
         let start = u16::from_be_bytes([pdu[0], pdu[1]]) as usize;
         let count = u16::from_be_bytes([pdu[2], pdu[3]]) as usize;
         let bytecount = pdu[4] as usize;
-        if count == 0 || count > 1968 || bytecount != count.div_ceil(8) || pdu.len() != 5 + bytecount
+        if count == 0
+            || count > 1968
+            || bytecount != count.div_ceil(8)
+            || pdu.len() != 5 + bytecount
         {
             return Err(exc::ILLEGAL_DATA_VALUE);
         }
@@ -361,7 +372,8 @@ mod tests {
     fn coils_write_then_read() {
         let mut s = ModbusSlave::new(1, 0, 16);
         // FC05 write single coil 3 = ON
-        s.handle_frame(&request(1, &[0x05, 0, 3, 0xFF, 0x00])).unwrap();
+        s.handle_frame(&request(1, &[0x05, 0, 3, 0xFF, 0x00]))
+            .unwrap();
         assert!(s.coil(3));
         // FC01 read coils 0..8 -> bit 3 set => byte 0x08
         let resp = s.handle_frame(&request(1, &[0x01, 0, 0, 0, 8])).unwrap();