public-readiness: scrub internal details, split licensing, hosted kernel-build

Preparing the repo to go public (ADR-0007):

- CI: kernel-build moves from the self-hosted runner to ubuntu-latest
  (installs its own cross toolchain + qemu, caches the pristine tarball).
  On a public repo a registered self-hosted runner is reachable from
  approved fork-PR workflows — i.e. arbitrary code on private
  infrastructure — and the build never actually needed the SDK host.
  ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site
  specifics now live only in the private deployment log).
- Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the
  kernel source excerpts (Linux derivatives; per-driver provenance was
  already tracked in PROVENANCE.md); patches/README.md states it too.
- Scrubbed from the tip: bench-unit dev credentials and its gadget IP
  (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID
  and the device WLAN MAC (wifi bring-up evidence — BSSIDs are
  geolocatable), the runner mesh IP. NOTE: these remain in git history;
  decision on a pre-publication history rewrite is separate.
- Emoji cleanup across 21 tracked files (kernel port docs, review report,
  enforce-mcdc.sh) per repo text conventions: status marks became
  [x]/[wip]/[ ]/OK plain text.
- "[maintainer]-gated" process phrasing normalized to "maintainer-gated"
  (attributions in dated evidence docs kept).

Verified: zero emojis tracked; scrub grep clean; patches carry no internal
references; ci.yml parses; shellcheck unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

docs/decisions/0003-standalone-repo.md

@@ -10,11 +10,11 @@ no CI, tests, or versioning of their own. The SDK requirement (future-features-2
 ## Decision
 A **private** `bfe-noah/warden-sdk` GitHub repo, standalone from day one with its own
 CI/versioning. Work lands on a `bringup` branch; the first commit to `main` is gated
-on a passing code-review-harness run, green CI, and [maintainer]'s fresh explicit go-ahead.
+on a passing code-review-harness run, green CI, and the maintainer's fresh explicit go-ahead.
 
 ## Consequences
 - flare-edge consumes warden-sdk later (flared depending on `warden-sim`, drivers
-  built from here) — a separate, [maintainer]-gated integration step; flare-edge is not
+  built from here) — a separate, maintainer-gated integration step; flare-edge is not
   edited by the SDK-completion effort.
 - Private for now (references bench devices / in-progress hardening); can be opened
   later once scrubbed, matching how `flare-deployment` is handled.

docs/decisions/0004-ci-runner.md

@@ -1,6 +1,8 @@
 # ADR 0004 — CI/CD runner: 3rd repo-scoped self-hosted runner on 0640
 
-**Status:** Accepted (2026-08-25).
+**Status:** Superseded in part by ADR-0007 (2026-08-30) — `kernel-build` moved
+to GitHub-hosted runners for the public repo and the self-hosted registration
+is retired. Original decision below, kept for the record. (2026-08-25.)
 
 ## Context
 The heavy kernel/firmware build needs the SDK toolchain and Buildroot's baked-in

docs/decisions/0005-driver-source-of-truth.md

@@ -12,7 +12,7 @@ scratch tree (`flare-edge/research/linux-6.18.46/`).
 Bring **hardened copies into `warden-sdk/drivers/`** as the canonical source-of-truth,
 each with its HAL seam and a 100% MC/DC host harness. The RV1106 kernel deltas are
 formalized as a patch series in `patches/`. flare-edge consumes warden-sdk later
-(separate, [maintainer]-gated step).
+(separate, maintainer-gated step).
 
 ## Consequences
 - Realizes the seam architecture (ADR-referenced in `docs/architecture.md`).

docs/decisions/0007-public-repo-hosted-kernel-build.md

@@ -0,0 +1,37 @@
+# ADR 0007 — Public repo: kernel-build moves to GitHub-hosted runners
+
+**Status:** Accepted (2026-08-30). Supersedes the runner half of ADR-0004.
+
+## Context
+The repo is going public (free Actions minutes for hosted runners; open-source
+alignment with the stack philosophy). Two facts change the ADR-0004 calculus:
+
+1. **A self-hosted runner on a public repo is a standing hazard.** A fork PR
+   can modify workflow files; once any run of theirs is approved, workflows
+   can target the repo's registered self-hosted runners — i.e. arbitrary code
+   on the private host, which also serves production. GitHub's own guidance is
+   to never attach self-hosted runners to public repos, and personal-account
+   repos have no runner groups to scope the risk away.
+2. **The build never needed the SDK host.** ADR-0004's premise ("needs the SDK
+   toolchain and Buildroot's baked-in absolute paths") does not apply to
+   `kernel-build`: the hermetic build is freestanding, uses Debian's
+   `gcc-arm-linux-gnueabihf`, and self-provisions `python`. It fits a hosted
+   runner (4 vCPU / 16 GB), and public-repo minutes are free.
+
+## Decision
+`kernel-build` runs on `ubuntu-latest`, apt-installing its toolchain, kernel
+build deps, and qemu-system-arm, with the pristine tarball cached like
+`patches-apply` does. It stays `workflow_dispatch`-only for now (a full build
+per push is still noisy; flipping it to push-on-main later is one line). The
+`warden-sdk` self-hosted runner instance is **deregistered from this repo**
+before it goes public; the flare and flare-edge runner instances on the same
+host are unaffected (those repos stay private).
+
+## Consequences
+- No path from public workflows to private infrastructure; nothing to babysit
+  in fork-PR approval settings beyond GitHub's defaults (still set "require
+  approval for all outside contributors" as belt-and-braces).
+- Kernel artifacts no longer persist on the runner host; the GitHub artifact
+  (5-day retention + prune job) is the only build output channel.
+- Hosted kernel builds are slower than the 0640 box but free and parallel;
+  the boot-smoke step rides along unchanged.