review: iteration-3 fixes (convergence pass)

- ci-cd.md phrasing made time-invariant (true before and after the
  visibility flip; the prior wording asserted a state not yet real).
- ui-shot: liveness check before the tap QMP call too — the commit-message
  claim of "before every QMP call" is now actually true.
- busybox fetcher checks its pin before downloading, mirroring the
  kernel-tarball fetcher's ordering.
- Fragment disable-arm: absence of a deps-gated symbol is a valid disable
  outcome; only "still set" is fatal (the iteration-2 symmetrization
  overcorrected). Negative-tested both directions under set -e.

Iteration 3 produced four findings, none blocking, all applied — the
recursive review is converged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

docs/ci-cd.md

@@ -1,9 +1,9 @@
 # CI/CD
 
 `.github/workflows/ci.yml` — every job runs on GitHub-hosted `ubuntu-latest`.
-No self-hosted runner is (or may be) reachable from this repo's workflows:
-the repo is public, and a fork PR that gets one approved run could
-otherwise execute code on private infrastructure (ADR-0007).
+No self-hosted runner is (or may be) reachable from this repo's workflows —
+on a public repo, a fork PR that gets one approved run could otherwise
+execute code on private infrastructure (ADR-0007).
 
 ## Jobs