public-readiness: scrub internal details, split licensing, hosted kernel-build

Preparing the repo to go public (ADR-0007):

- CI: kernel-build moves from the self-hosted runner to ubuntu-latest
  (installs its own cross toolchain + qemu, caches the pristine tarball).
  On a public repo a registered self-hosted runner is reachable from
  approved fork-PR workflows — i.e. arbitrary code on private
  infrastructure — and the build never actually needed the SDK host.
  ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site
  specifics now live only in the private deployment log).
- Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the
  kernel source excerpts (Linux derivatives; per-driver provenance was
  already tracked in PROVENANCE.md); patches/README.md states it too.
- Scrubbed from the tip: bench-unit dev credentials and its gadget IP
  (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID
  and the device WLAN MAC (wifi bring-up evidence — BSSIDs are
  geolocatable), the runner mesh IP. NOTE: these remain in git history;
  decision on a pre-publication history rewrite is separate.
- Emoji cleanup across 21 tracked files (kernel port docs, review report,
  enforce-mcdc.sh) per repo text conventions: status marks became
  [x]/[wip]/[ ]/OK plain text.
- "[maintainer]-gated" process phrasing normalized to "maintainer-gated"
  (attributions in dated evidence docs kept).

Verified: zero emojis tracked; scrub grep clean; patches carry no internal
references; ci.yml parses; shellcheck unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

docs/architecture.md

@@ -65,7 +65,7 @@ supervisor logic runs in CI with no panel.
   the boot-mode register's survives-warm-reset / cleared-by-POR behaviour (the MaskRom
   recovery maneuver). The matching firmware-side `Bus` seam on flared's `devmem` — so
   the shipped ladder can be asserted to poke the confirmed offset, never the wrong-SoC
-  one — lands when flare-edge consumes warden-sdk (§7 item 3, [maintainer]-gated), not yet on
+  one — lands when flare-edge consumes warden-sdk (§7 item 3, maintainer-gated), not yet on
   flare-edge `main`.
 - **`modbus` — RS-485 device end.** Done. `ModbusSlave`: a byte-in/byte-out RTU slave
   (CRC16 byte-identical to the master, FC 0x01–0x06/0x0F/0x10/0x11, exception replies,
@@ -88,7 +88,7 @@ supervisor logic runs in CI with no panel.
 Integration with flare-edge: flared implements `MemBus` for `/dev/mem` and gains
 `#[cfg(test)]` tests driving its real arm/beat logic against `HpmcuSim`. This needs
 warden-sdk reachable as a Cargo dependency in CI — i.e. a remote for this repo,
-which is a **[maintainer]-go-ahead item** (credential/remote creation). Until then the
+which is a **maintainer go-ahead item** (credential/remote creation). Until then the
 firmware-side seam and a local test double land in flare-edge, unified with `sim/`
 once the dependency exists. No duplication of *logic* — only the tiny trait.
 
@@ -185,7 +185,7 @@ memory-map faults; and "boots under emulation" is never on-silicon evidence.
 2. **C-driver MC/DC harnesses** — `relays.c` and `freshness.c` at 100% MC/DC, CI-gated
    via the shared `drivers/enforce-mcdc.sh`. **Done** (the first C coverage gate).
 3. **flared devmem/hpmcu seam + tests** — firmware-side trait, unified with `sim/`
-   once flare-edge consumes warden-sdk (a separate, [maintainer]-gated step). **Pending.**
+   once flare-edge consumes warden-sdk (a separate, maintainer-gated step). **Pending.**
 4. **Config-lint CI gates** (§5) — the brick-class of bug. **Done.**
 5. **Hermetic kernel build** (`build/build-kernel.sh` + the `patches-apply` gate). **Done.**
 6. **Kernel 5.10→6.18.46 forward-port** (§6, ADR-0001). **Done** (hardware-verified).