scripts/docs: fail loudly, fix names, document bring-up-only status

install-forgefirm.sh completed silently broken when the download, flash
write, mount or uEnv rewrite failed - add die() checks around every
critical step (audit N13/M12) and download the release asset under the
exact Scarthgap artifact name (forgefirm-image-glowforge.rootfs.wic.gz)
so uploads need no renaming. ffboot no longer depends on the never-
provisioned /etc/fw_env_mmcblk2.config: it falls back to
/etc/fw_env.config (which both the factory and ForgeFIRM images ship,
pointing at the eMMC env) and checks fw_setenv results (audit N16).
BUILD.md gets the real artifact name and marks the built u-boot
reference-only; INSTALL.md drops the stale script/ogboot names and the
cloud-connect promise, stating the image is bring-up-only (audit N11).

BUILD.md

@@ -53,9 +53,14 @@ kas fetches the upstream layers into `forgefirm/layers/`, builds in
 `forgefirm/build/`, and produces the bootable image at:
 
 ```
-forgefirm/build/tmp/deploy/images/glowforge/forgefirm-image-glowforge.wic.gz
+forgefirm/build/tmp/deploy/images/glowforge/forgefirm-image-glowforge.rootfs.wic.gz
 ```
 
+(The `u-boot-glowforge.imx` also deployed there is **reference-only**: every
+supported install/boot flow keeps the factory bootloader on the eMMC. Its env
+Kconfig now matches the factory layout — 0x80000 primary / 0x82000 redundant —
+but it is not wired into any install path and flashing it is unsupported.)
+
 For exact, reproducible layer versions, generate a lockfile once:
 
 ```console
@@ -69,7 +74,7 @@ and the Scarthgap migration backlog.
 
 ```console
 cd build/tmp/deploy/images/glowforge
-sudo zcat forgefirm-image-glowforge.wic.gz | dd of=/dev/sdX bs=1M
+sudo zcat forgefirm-image-glowforge.rootfs.wic.gz | dd of=/dev/sdX bs=1M
 ```
 
 To install onto the factory eMMC (dual-boot with the Glowforge firmware), see