build: produce the matched 6.18 module set (issue #4 root cause)

The hermetic build only ever made zImage+dtb — no 6.18 .ko set existed,
so the panel's only aic8800_btlpm.ko was the stale 5.10 build, which
fails the struct-module ABI check at load. New WARDEN_MODULES_COLLECT
env runs the full `make modules` (required: zImage alone emits no
Module.symvers, so per-directory M= builds cannot link) and collects the
listed dirs' modules fail-closed; CI's kernel-build collects
drivers/net/wireless/aic8800 and ships the .ko files in the artifact.

Verified: all three aic8800 modules (bsp 326K, fdrv 1.5M, btlpm 36K)
compile clean against 6.18, and bsp+btlpm INSMOD WITH RC=0 on the 6.18
kernel in the qemu/ device sim — no linkonce/this_module ABI error;
btlpm's rfkill init runs and only hardware power-up fails (no AIC silicon
on virt, expected). On-panel BT bring-up remains bench-gated (c8a3
currently dark).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

.github/workflows/ci.yml

@@ -220,6 +220,11 @@ jobs:
           CROSS_COMPILE: arm-linux-gnueabihf-
           WARDEN_CCACHE: 1
           CCACHE_DIR: /home/runner/.ccache
+          # Matched module set for the out-of-tree wifi/BT drivers (issue #4:
+          # a stale 5.10 .ko was all the panel had). Full `make modules` runs
+          # (zImage alone emits no Module.symvers); only these dirs' .ko files
+          # are collected/uploaded.
+          WARDEN_MODULES_COLLECT: drivers/net/wireless/aic8800
         # KERNEL_TARBALL is exported from the SHELL so $HOME expands — a literal
         # `~` in a YAML env: value is never tilde-expanded and broke every
         # dispatch until caught in review.
@@ -246,6 +251,7 @@ jobs:
           path: |
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/modules-out/*.ko
           # Short so kernel images self-expire instead of piling into the
           # account-wide storage quota; the prune-artifacts job above is the
           # active bound, this is the backstop.