kas: record the push/release order and lock upstream layers

kernel-module-glowforge and python3-gfhardware are now pushed and pinned by
SRCREV in meta-openglow (no AUTOREV anywhere), and the meta-openglow
Scarthgap port is published on its scarthgap branch. Record the full
push/release sequencing in kas/README.md (incl. the release-time flip to the
pinned-remote meta-openglow block and the release-asset naming rule), and
commit the kas lockfile pinning poky/meta-openembedded/meta-freescale(-distro)
at the revisions the working build used.

The untracked kas/externalsrc-dev.yml overlay (local python3-gfhardware via
/mnt/c) is removed: the pinned SRCREV replaces it.

kas/README.md

@@ -85,6 +85,46 @@ kas lock kas/forgefirm-glowforge.yml      # writes kas/forgefirm-glowforge.lock.
 
 kas auto-loads the lockfile on subsequent runs. Commit it; refresh deliberately.
 
+## Push & release order (source-of-truth sequencing)
+
+The build is only reproducible when recipe pins, layer branches, and the kas
+config move in the right order (audit findings M13/N14 — the old `AUTOREV` +
+untracked-overlay setup meant a plain `kas build` fetched the wrong camera
+code). The sequence, with current status:
+
+1. **Source repos pushed & pinned** — **DONE 2026-07-26.**
+   `kernel-module-glowforge` (`029dfb6`) and `python3-gfhardware` (`9bf31fd`)
+   pushed to GitHub master; both recipes in meta-openglow pin those exact
+   SRCREVs (no `AUTOREV` anywhere). Whenever either repo changes: push it,
+   then bump the recipe `SRCREV` in meta-openglow deliberately.
+2. **meta-openglow pushed** — **DONE 2026-07-26.** The Scarthgap port lives on
+   the **`scarthgap` branch** (Yocto layer convention; the Dunfell-era `master`
+   is untouched). Development continues on the local sibling checkout; push /
+   fast-forward `scarthgap` as work lands.
+3. **forgefirm pushed** with the kas config and a `kas lock` lockfile pinning
+   the upstream layers (poky, meta-openembedded, meta-freescale,
+   meta-freescale-distro).
+4. **At release time** — gated on the audit **Phase 1 motion fixes** (do not
+   ship an image while the cnc-probe and SDMA-firmware-collision defects make
+   motion dead on arrival, AUDIT-REPORT B1/M1):
+   - flip `meta-openglow` in `forgefirm-glowforge.yml` from the local-sibling
+     block to the pinned-remote block (commented FUTURE block in the file);
+   - drop meta-openglow's `kernel-module-glowforge.bbappend` (externalsrc to
+     the local sibling — its perl-native DEPENDS is already carried in the
+     base recipe) so a fresh clone is fully self-contained;
+   - refresh `kas lock`, tag all repos, and prove self-containment by building
+     from a **fresh clone**.
+5. **GitHub release**: upload the image asset under the exact name the
+   installer downloads — Scarthgap emits
+   `forgefirm-image-glowforge.rootfs.wic.gz`; align BUILD.md and
+   `install-forgefirm.sh` to one name before the first release (audit N13).
+
+Dev-overlay note: `kas/externalsrc-dev.yml` (an untracked overlay building
+python3-gfhardware from a local checkout via `/mnt/c`) was removed when the
+SRCREV was pinned. For future gfhardware development, either bump the pin per
+iteration or add a tracked externalsrc bbappend mirroring the kernel-module
+pattern.
+
 ## Scarthgap migration backlog
 
 The kas scaffold + `LAYERSERIES_COMPAT` bumps let the layers be *selected* under

kas/forgefirm-glowforge.lock.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+overrides:
+  repos:
+    poky:
+      commit: 70ed6f677234d32198371a030178d2f272cf2d94
+    meta-openembedded:
+      commit: b0c2c648a1af89e7a8dd4c2ec841f3bc0ed0ccb9
+    meta-freescale:
+      commit: b699d026506a6fc402e03afb432dcabd3d81c7ab
+    meta-freescale-distro:
+      commit: b9d6a5d9931922558046d230c1f5f4ef6ee72345

kas/forgefirm-glowforge.yml

@@ -86,11 +86,15 @@ repos:
       meta-glowforge-bsp:
       # meta-openglow-bsp (separate OpenGlow_std board) intentionally excluded.
   #
-  # FUTURE (once the meta-openglow scarthgap migration is committed/pushed,
+  # FUTURE — flip to this pinned-remote block at release time (the scarthgap
-  # making forgefirm fully self-contained — clone forgefirm, run kas, done):
+  # branch is pushed as of 2026-07-26, so this now works; the flip is gated on
+  # active BSP development settling — see kas/README.md "Push & release order".
+  # When flipping, also drop meta-openglow's kernel-module-glowforge.bbappend
+  # (externalsrc to the local sibling) so a fresh clone is self-contained; its
+  # perl-native DEPENDS is already carried in the base recipe):
   #   meta-openglow:
   #     url: https://github.com/ScottW514/meta-openglow.git
-  #     branch: scarthgap          # or a pinned commit / tag
+  #     branch: scarthgap          # pin via kas lock / a tag at release
   #     path: layers/meta-openglow
   #     layers:
   #       meta-openglow-core: