docs: build p30, image 20260903000529, the campaign's image

BRINGUP item 9: the deferred batch is on image 20260903000529; owed is the
flash, the fresh-boot baseline, and the full campaign, then the push and
the pin bumps. CAMPAIGN-LOG: the p30 build and its checks.

docs/BRINGUP.md

@@ -1373,11 +1373,13 @@ feature requests, enhancements) will eventually be tracked as GitHub issues.
     pins, the kernel and the module rebuilt together for the watchdog sysfs
     change, and is not the image the campaign runs on: the campaign waits
     until every audit finding, the deferred ones included, is on one image
-    (the operator's rule). That batch is done (item 11) and rides the next
+    (the operator's rule). That batch is done (item 11) and is on the local
-    local image, which is the campaign's. Owed now: build it, flash the dev
+    image 20260903000529 (release and dev; the module built from its local
-    image, take a fresh-boot baseline, run the full campaign on it, the
+    commit at 0.0.3, the kernel from the edited patches, everything else
-    campaign the release gate asks for; then the push in CI order and the
+    from the pushed pins), which is the campaign's image. Owed now: flash
-    pin bumps for the batch.
+    the dev image, take a fresh-boot baseline, run the full campaign on it,
+    the campaign the release gate asks for; then the push in CI order and
+    the pin bumps for the batch.
     Decisions taken in the remediation that the operator confirms or reverses:
     the release image has no shell login (the install page now says so); the
     cloud client holds and resumes on the cooling verdict with a 30-minute

docs/CAMPAIGN-LOG.md

@@ -7408,6 +7408,26 @@ Owed: one local image with the batch (the module pinned from its local
 commit, the rest from the pushed pins), the flash, the fresh-boot baseline
 and the full campaign; then the push in CI order and the pin bumps.
 
+## 2026-09-02: build p30, the campaign's image
+
+Build p30 carries the deferred batch on top of the pushed pins: the module
+from its local commit (pinned for this build only through a kas overlay,
+its download mirror primed from the local repository, at version 0.0.3),
+the kernel from the edited patches, the distro conf, the suite with the new
+drill. Fetch-verify green; the kernel and the module cleaned together; both
+images built clean, release and dev `20260903000529`. The checks: the
+kernel and the module both name `6.12.20-fslc-fslc-gbe4aba1c1504`; the dev
+manifest records the module at its batch commit and 0.0.3 and every other
+component at its pushed pin; the module in the dev image carries the
+mailbox and inhibit strings and the 32-word script, with a vermagic that
+matches the kernel; the patched tree carries the dmaengine claim and the
+word_delay source; the suite in the image carries `kernel.resume-lead`;
+`WATCHDOG_SYSFS`, `IMX2_WDT` and `STRICT_DEVMEM` are set; no gfui-client;
+`nofail` factory slots; no mmap or ctypes in the release image; no QA
+warnings. Owed: the operator flashes the dev image, takes a fresh-boot
+baseline, and runs the full campaign; then the push in CI order and the
+pin bumps.
+
 ## Reference notes
 
 ### Head-IRQ source validation — the beam-emission hypothesis