review: iteration-3 fixes (convergence pass)

- ci-cd.md phrasing made time-invariant (true before and after the
  visibility flip; the prior wording asserted a state not yet real).
- ui-shot: liveness check before the tap QMP call too — the commit-message
  claim of "before every QMP call" is now actually true.
- busybox fetcher checks its pin before downloading, mirroring the
  kernel-tarball fetcher's ordering.
- Fragment disable-arm: absence of a deps-gated symbol is a valid disable
  outcome; only "still set" is fatal (the iteration-2 symmetrization
  overcorrected). Negative-tested both directions under set -e.

Iteration 3 produced four findings, none blocking, all applied — the
recursive review is converged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

build/build-kernel.sh

@@ -129,11 +129,14 @@ if [ -n "${WARDEN_KCONFIG_FRAGMENT:-}" ]; then
           frag_fail=1
         } ;;
       "# CONFIG_"*" is not set")
-        # Symmetric with the enable arm: the exact disable line must be
-        # present. A symbol absent entirely means a typo'd/renamed option,
-        # not a successful disable.
-        grep -qxF "$line" "$SRC/.config" || {
-          echo "FATAL: fragment line '$line' not reflected in the final .config" >&2
+        # A disable succeeded if the symbol is NOT set: Kconfig writes either
+        # the literal "is not set" line or (when dependencies gate the symbol
+        # out) nothing at all — both are valid outcomes. Only "still =value"
+        # is a failed disable. (A typo'd symbol disables nothing and is
+        # harmless by construction.)
+        opt="${line#\# }"; opt="${opt% is not set}"
+        grep -qE "^$opt=" "$SRC/.config" && {
+          echo "FATAL: fragment disabled '$opt' but it is still set in the final .config" >&2
           frag_fail=1
         } ;;
     esac