Register the Z envelope harness and record the rebase

A new scripts/bench python file must be entered in the bench registry as
well as in that directory's README: the registry is what the acceptance
page reads, and a file in neither is a tool nobody can find. The harness
joins the other two host-side CI harnesses, marked not a bench-page tool
for the same reason they are - it drives the host-built null-sink
controller, not the machine.

CAMPAIGN-LOG gets the dated record of the rebase onto core build
20260905: the settings-struct measurement taken before the machine was
touched, the harness and the two broken builds it was validated against,
and the bench results.

forgetest/forgetest/bench.py

@@ -244,6 +244,11 @@ TOOLS = [
      "safety": "dry", "where": "host", "ported": False, "args": [],
      "desc": "Arm/disarm lifecycle on the null-sink controller. A CI harness (the grblHAL repo): needs the "
              "host-built null-sink controller, not the machine, so it is not a bench-page tool."},
+    {"id": "z-envelope-test", "title": "Z envelope harness", "script": "z_envelope_test.py",
+     "safety": "dry", "where": "host", "ported": False, "args": [],
+     "desc": "The Z soft limit belongs to the driver, not to $20: an unreferenced Z is collapsed to where the "
+             "lens stands, and neither a $20 nor a $132 write frees it. A CI harness (the grblHAL repo): needs "
+             "the host-built null-sink controller, not the machine, so it is not a bench-page tool."},
     {"id": "puls-profile", "title": "Factory .puls profile decoder", "script": "puls_profile.py",
      "safety": "dry", "where": "host", "ported": False, "args": [],
      "desc": "Decodes factory pulse streams into velocity/accel profiles. Runs anywhere; needs a .puls file "