forgetest: image.health matches the kernel by identity, hash aside

The manifest lists the modules directory without the kernel's
LOCALVERSION_AUTO hash (the hash does not reproduce across a re-patch of
the same source, so the image manifest strips it). image.health still
compared the full running release against that list and failed on the
first post-flash run of image 20260902144848 with the kernel
6.12.20-fslc-fslc-g72a0b1431a9d against the manifest's 6.12.20-fslc-fslc.

kernel_ident() strips the same suffix from both sides, so a manifest with
or without the hash matches the running kernel, and a different base
release still fails. tests/test_image.py covers both forms.

Catalog consequence: only image.health's own implementation hash moves;
it is an always-run test, so no inherited result is affected.

forgetest/forgetest/suite/image.py

@@ -41,6 +41,20 @@ def kernel_config():
     return cfg
 
 
+def kernel_ident(name):
+    """A kernel release or modules-directory name less its LOCALVERSION_AUTO
+    hash (+g<hash> or -g<hash>). The hash does not reproduce across a
+    re-patch of the same source; the manifest lists modules directories
+    without it, and the kernel's identity is its @srcrev and @config."""
+    return re.sub(r"[+-]g[0-9a-f]{7,}$", "", name)
+
+
+def kernel_matches(release, modules_dirs):
+    """True when the running release names one of the manifest's modules
+    directories, hashes aside (a manifest without them constrains nothing)."""
+    return not modules_dirs or kernel_ident(release) in {kernel_ident(m) for m in modules_dirs}
+
+
 def _dt_u32(path):
     """A device-tree cell as an int (big-endian), or None."""
     try:
@@ -97,7 +111,7 @@ def image_health(ctx):
     ev["kernel_release"] = rel
     mods = manifest.platform.get("kernel_modules") or []
     ctx.log("kernel release %s (manifest modules dirs: %s)", rel, ",".join(mods))
-    ctx.check(not mods or rel in mods, "running kernel %r is not the manifest's %s", rel, mods)
+    ctx.check(kernel_matches(rel, mods), "running kernel %r is not the manifest's %s", rel, mods)
 
     # 3. the module and its sysfs
     ctx.check(os.path.isdir("/sys/module/glowforge"), "glowforge.ko is not loaded")

forgetest/tests/test_image.py

@@ -0,0 +1,24 @@
+import unittest
+
+from forgetest.suite import image
+
+
+class KernelIdentTests(unittest.TestCase):
+    def test_localversion_hash_is_stripped(self):
+        self.assertEqual(image.kernel_ident("6.12.20-fslc-fslc-g72a0b1431a9d"), "6.12.20-fslc-fslc")
+        self.assertEqual(image.kernel_ident("6.12.20-fslc-fslc+g72a0b1431a9d"), "6.12.20-fslc-fslc")
+
+    def test_plain_name_is_unchanged(self):
+        self.assertEqual(image.kernel_ident("6.12.20-fslc-fslc"), "6.12.20-fslc-fslc")
+        self.assertEqual(image.kernel_ident("6.12.20-fslc-g12"), "6.12.20-fslc-g12")
+
+    def test_release_matches_manifest_with_or_without_hash(self):
+        rel = "6.12.20-fslc-fslc-g72a0b1431a9d"
+        self.assertTrue(image.kernel_matches(rel, ["6.12.20-fslc-fslc"]))
+        self.assertTrue(image.kernel_matches(rel, ["6.12.20-fslc-fslc-gf52af5b522f4"]))
+        self.assertTrue(image.kernel_matches(rel, []))
+        self.assertFalse(image.kernel_matches(rel, ["6.12.19-fslc-fslc"]))
+
+
+if __name__ == "__main__":
+    unittest.main()