review: iteration-2 fixes (fragment assertion, evidence paths, hardening)

- build-kernel.sh fragment assertion: survives a missing trailing newline
  (the read footgun, reproduced) and treats an absent symbol on a disable
  line as FATAL, symmetric with the enable arm.
- fetch-kernel-tarball.sh checks the pin before downloading; both fetchers
  add --retry-connrefused.
- mkimage rejects '.'/'..' state keys.
- ui-shot: VM liveness checked before every QMP call, console.log preserved
  as evidence on every failure path, repaint deadline widened to 90s with
  the contended-runner rationale documented.
- rs485-bridge: overflow discards back off one gap and rate-limit their log
  line, mirroring the accept-loop fix; clippy nit fixed.
- .gitignore ignores *.elf/*.map so the untracked artifacts cannot silently
  return; CI shellcheck glob now covers build/ and the rootfs boot scripts
  (directives added for the deliberate in-guest source paths).
- Docs: NPU parity row matches its sibling verification docs; line-pinned
  audit cross-references unpinned; CROSS_COMPILE documented in the build
  header; payload README lists warden-ui; ci-cd tense settled.

Verified: guards negative-tested (bad state keys, no-newline fragment);
boot smoke, portal scenario, ui-shot all PASS; 53 tests green; shellcheck
clean across the widened glob; clippy zero.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

build/build-kernel.sh

@@ -10,6 +10,8 @@
 # Env:
 #   KERNEL_TARBALL   path to a local linux-6.18.46.tar.xz (skips the download)
 #   SDK_TC           dir holding the arm-rockchip830 uclibc cross toolchain bin/
+#   CROSS_COMPILE    cross-compiler prefix (default arm-rockchip830-linux-uclibcgnueabihf-;
+#                    CI overrides with the generic arm-linux-gnueabihf-)
 #   WORK             build scratch dir (default: a mktemp under $TMPDIR)
 #   JOBS             parallel make jobs (default: nproc)
 #   WARDEN_KCONFIG_FRAGMENT
@@ -119,7 +121,7 @@ make -C "$SRC" ARCH=arm CROSS_COMPILE="$CROSS_COMPILE" olddefconfig >/dev/null
 # request in the fragment survived into the final .config; fail loud if not.
 if [ -n "${WARDEN_KCONFIG_FRAGMENT:-}" ]; then
   frag_fail=0
-  while IFS= read -r line; do
+  while IFS= read -r line || [ -n "$line" ]; do
     case "$line" in
       CONFIG_*=*)
         grep -qxF "$line" "$SRC/.config" || {
@@ -127,9 +129,11 @@ if [ -n "${WARDEN_KCONFIG_FRAGMENT:-}" ]; then
           frag_fail=1
         } ;;
       "# CONFIG_"*" is not set")
-        opt="${line#\# }"; opt="${opt% is not set}"
-        grep -qE "^$opt=" "$SRC/.config" && {
-          echo "FATAL: fragment disabled '$opt' but it is set in the final .config" >&2
+        # Symmetric with the enable arm: the exact disable line must be
+        # present. A symbol absent entirely means a typo'd/renamed option,
+        # not a successful disable.
+        grep -qxF "$line" "$SRC/.config" || {
+          echo "FATAL: fragment line '$line' not reflected in the final .config" >&2
           frag_fail=1
         } ;;
     esac

build/fetch-kernel-tarball.sh

@@ -14,14 +14,16 @@ URL="https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-$KVER.tar.xz"
 
 TB="${1:?usage: fetch-kernel-tarball.sh <destination-path>}"
 
-if [ ! -f "$TB" ]; then
-  echo "== downloading $URL"
-  curl --retry 3 --retry-delay 5 -fSL "$URL" -o "$TB"
-fi
+# Pin first: a forgotten pin on a KVER bump should refuse BEFORE burning a
+# 140MB download it will then reject anyway.
 [ -f "$SHA_FILE" ] || {
   echo "FATAL: no pinned sha256 for linux-$KVER (expected $SHA_FILE) — refusing an unverified tarball" >&2
   exit 1
 }
+if [ ! -f "$TB" ]; then
+  echo "== downloading $URL"
+  curl --retry 3 --retry-delay 5 --retry-connrefused -fSL "$URL" -o "$TB"
+fi
 want="$(cat "$SHA_FILE")"
 got="$(sha256sum "$TB" | awk '{print $1}')"
 [ "$want" = "$got" ] || { echo "FATAL: tarball sha256 mismatch: want $want got $got" >&2; exit 1; }