public-readiness: scrub internal details, split licensing, hosted kernel-build

Preparing the repo to go public (ADR-0007):

- CI: kernel-build moves from the self-hosted runner to ubuntu-latest
  (installs its own cross toolchain + qemu, caches the pristine tarball).
  On a public repo a registered self-hosted runner is reachable from
  approved fork-PR workflows — i.e. arbitrary code on private
  infrastructure — and the build never actually needed the SDK host.
  ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site
  specifics now live only in the private deployment log).
- Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the
  kernel source excerpts (Linux derivatives; per-driver provenance was
  already tracked in PROVENANCE.md); patches/README.md states it too.
- Scrubbed from the tip: bench-unit dev credentials and its gadget IP
  (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID
  and the device WLAN MAC (wifi bring-up evidence — BSSIDs are
  geolocatable), the runner mesh IP. NOTE: these remain in git history;
  decision on a pre-publication history rewrite is separate.
- Emoji cleanup across 21 tracked files (kernel port docs, review report,
  enforce-mcdc.sh) per repo text conventions: status marks became
  [x]/[wip]/[ ]/OK plain text.
- "[maintainer]-gated" process phrasing normalized to "maintainer-gated"
  (attributions in dated evidence docs kept).

Verified: zero emojis tracked; scrub grep clean; patches carry no internal
references; ci.yml parses; shellcheck unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

kernel/docs/m2-boot-on-c8a3.md

@@ -7,9 +7,10 @@ findings — they worked on the first hardware try.**
 
 ## The safe test path (A/B slot _b, never touch _a)
 
-c8a3 is the XPS-connected Warden: eth0 `[bench-ip]` over USB-gadget ([bench-creds],
-dropbear — use `scp -O`, no sftp-server), plus the serial console on xps
-`/dev/ttyUSB2` @115200 and Zigbee power (`plug_cmd.py cycle`). It runs an A/B
+c8a3 is the desk-connected bench Warden: reachable over its USB-gadget ethernet
+(dev-build dropbear; address and bench credentials live in the private
+deployment notes — use `scp -O`, no sftp-server), plus the serial console at
+115200 and remotely switchable power. It runs an A/B
 firmware (boot_a=mmcblk0p5 / boot_b=mmcblk0p6, 32 MiB each; rootfs_a/_b; AvbABData
 in `misc` sector 4 / byte 2048).
 
@@ -51,7 +52,7 @@ With the correct format, U-Boot loaded my kernel + my DTB and printed my DT mode
 string (`Model: WardenOS 86-Panel (RV1106) — M2 earlycon bring-up`), then
 `Starting kernel ...`.
 
-## Result: ✅ M2 achieved — the 6.18 kernel boots on hardware
+## Result: [x] M2 achieved — the 6.18 kernel boots on hardware
 
 Six attempts, each auto-recovering to `_a`, then a clean boot:
 
@@ -84,7 +85,7 @@ pre-MMU), then fixed:
 CP2102 bench adapter — so the M2 DT pins 115200 for readable bring-up; production
 overrides to 1.5M.
 
-## M3 (same session): ✅ the full WardenOS runs on the 6.18 kernel
+## M3 (same session): [x] the full WardenOS runs on the 6.18 kernel
 
 Adding the eMMC `dw_mmc` node (`mmc@ffa90000`, clocks from cru + grf_cru) was the
 only change M3 needed — the mmc/ext4 drivers are already in-config. The kernel
@@ -96,7 +97,8 @@ won't load (vermagic → M5), and there's no backlight/framebuffer yet (→ M4).
 
 **Console lesson applied:** with `console=ttyS2,115200` the whole boot is readable
 on the CP2102 (the 1.5M vendor rate is garbage on it). Serial login uses the same
-`c8a3_run.py` [bench-creds] helper as the 5.10 firmware — the userspace is unchanged.
+`c8a3_run.py` helper (dev-build bench credentials, see private deployment notes)
+as the 5.10 firmware — the userspace is unchanged.
 
 Next: M4 (VOP2 display + panel + touch), M5 (AIC8800 SDIO port + our 4 patches),
 M6 (RGA/watchdog/HPMCU/USB-OTG); plus a lean defconfig + Buildroot-on-6.18 cleanup.