build: produce the matched 6.18 module set (issue #4 root cause)

The hermetic build only ever made zImage+dtb — no 6.18 .ko set existed,
so the panel's only aic8800_btlpm.ko was the stale 5.10 build, which
fails the struct-module ABI check at load. New WARDEN_MODULES_COLLECT
env runs the full `make modules` (required: zImage alone emits no
Module.symvers, so per-directory M= builds cannot link) and collects the
listed dirs' modules fail-closed; CI's kernel-build collects
drivers/net/wireless/aic8800 and ships the .ko files in the artifact.

Verified: all three aic8800 modules (bsp 326K, fdrv 1.5M, btlpm 36K)
compile clean against 6.18, and bsp+btlpm INSMOD WITH RC=0 on the 6.18
kernel in the qemu/ device sim — no linkonce/this_module ABI error;
btlpm's rfkill init runs and only hardware power-up fails (no AIC silicon
on virt, expected). On-panel BT bring-up remains bench-gated (c8a3
currently dark).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

.github/workflows/ci.yml

@@ -220,6 +220,11 @@ jobs:
           CROSS_COMPILE: arm-linux-gnueabihf-
           WARDEN_CCACHE: 1
           CCACHE_DIR: /home/runner/.ccache
+          # Matched module set for the out-of-tree wifi/BT drivers (issue #4:
+          # a stale 5.10 .ko was all the panel had). Full `make modules` runs
+          # (zImage alone emits no Module.symvers); only these dirs' .ko files
+          # are collected/uploaded.
+          WARDEN_MODULES_COLLECT: drivers/net/wireless/aic8800
         # KERNEL_TARBALL is exported from the SHELL so $HOME expands — a literal
         # `~` in a YAML env: value is never tilde-expanded and broke every
         # dispatch until caught in review.
@@ -246,6 +251,7 @@ jobs:
           path: |
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/modules-out/*.ko
           # Short so kernel images self-expire instead of piling into the
           # account-wide storage quota; the prune-artifacts job above is the
           # active bound, this is the backstop.

build/build-kernel.sh

@@ -19,6 +19,12 @@
 #                    (qemu/configs/virt.fragment builds the QEMU -M virt variant);
 #                    every fragment option is verified to have taken effect
 #   WARDEN_CCACHE=1  compile through ccache (CI caches ~/.ccache)
+#   WARDEN_MODULES_COLLECT
+#                    space-separated in-tree dirs whose .ko files are wanted
+#                    (e.g. "drivers/net/wireless/aic8800"). Runs a full
+#                    `make modules` (the zImage target alone generates no
+#                    Module.symvers, so per-dir M= builds cannot link) and
+#                    collects the listed dirs' modules into $WORK/modules-out.
 #
 # Requires: `python` (not python3) on PATH — the SDK quirk; the CI runner provides
 # a project-local venv. Builds are SERIAL on the shared SDK box — never run two.
@@ -157,6 +163,28 @@ log "building zImage + rv1106-warden.dtb (-j$JOBS)"
 make -C "$SRC" ARCH=arm CROSS_COMPILE="$CROSS_COMPILE" CC="$KCC" -j"$JOBS" \
   zImage rockchip/rv1106-warden.dtb
 
+# Optional module set (issue #4: the panel loaded a stale 5.10 .ko because
+# this build never produced matched 6.18 modules). Full `make modules` is
+# required — zImage alone emits no Module.symvers, so a per-directory M=
+# build cannot resolve even core symbols. FAILS CLOSED if a listed dir
+# yields no modules.
+if [ -n "${WARDEN_MODULES_COLLECT:-}" ]; then
+  MODOUT="$WORK/modules-out"
+  rm -rf "$MODOUT"; mkdir -p "$MODOUT"
+  log "building modules (full set — needed for Module.symvers)"
+  make -C "$SRC" ARCH=arm CROSS_COMPILE="$CROSS_COMPILE" CC="$KCC" -j"$JOBS" modules
+  for d in $WARDEN_MODULES_COLLECT; do
+    [ -d "$SRC/$d" ] || { echo "FATAL: WARDEN_MODULES_COLLECT dir '$d' not in tree" >&2; exit 1; }
+    n=0
+    while IFS= read -r ko; do
+      cp "$ko" "$MODOUT/"; n=$((n + 1))
+    done < <(find "$SRC/$d" -name '*.ko')
+    [ "$n" -gt 0 ] || { echo "FATAL: no .ko produced under '$d'" >&2; exit 1; }
+    log "collected $n module(s) from $d"
+  done
+  ls -la "$MODOUT"
+fi
+
 Z="$SRC/arch/arm/boot/zImage"
 D="$SRC/arch/arm/boot/dts/rockchip/rv1106-warden.dtb"
 log "build OK"