Audit follow-through: runbook, bench tools, recipes, release tooling

BRINGUP describes the present: the 54-test catalog and its seven-test
always core, the tier counts, the shipped low-temperature gates, the
density floor ($35 = 10), the two local core commits, the ffboot env
write, the aa-offset route, the current bench image, and the bench
measurements the audit asks for (pooled into the next session). The
workstation shell notes and every em dash are gone.

forgetest: the takeover waits for the cloud client too (found by its
command line); the unauthenticated /boot probe names the endpoint's
parameter; the UI prose is American English. Recipes: forgetest
fetches its package directory and init script only and drops
__pycache__ at unpack; the dev image no longer re-adds forgectrl; the
release image's remove list drops the gfui-client the BSP no longer
has; the platform identity strips the kernel's local-version hash
from the modules directory name, so a re-patched kernel keeps its
fingerprints. grblhal restart is stop then start. release.sh --dev
packs the dev image. fixture.sh refuses a readable env file.

Bench tools: the live-fire drills measure the lid-IR baseline before
every run and point at the fire-watch thresholds the engine reads;
one thermistor conversion (gfbench.degc) serves every drill; the six
dated measurement records leave the tool directory; feeder.c names the
two sysfs writes its caller makes.

Host tests: forgetest 258 pass; the coverage lint reports no uncovered
path across 54 tests. Acceptance: forgectrl.auth covers the /boot
probe; update.* cover ffboot and the manifest identity; the runbook
and bench-tool changes have no catalog consequence.

meta-forgefirm/classes/forgefirm-image-manifest.bbclass

@@ -114,7 +114,7 @@ def forgefirm_manifest_sha256_file(path):
     return h.hexdigest()
 
 python forgefirm_manifest_assemble() {
-    import glob, hashlib, json, os
+    import glob, hashlib, json, os, re
 
     rootfs = d.getVar('IMAGE_ROOTFS')
     components = {}
@@ -145,7 +145,12 @@ python forgefirm_manifest_assemble() {
 
     layer_identity, layer_build = forgefirm_manifest_layers(d)
     platform = {'machine': d.getVar('MACHINE'), 'layers': layer_identity}
-    platform['kernel_modules'] = sorted(os.listdir(os.path.join(rootfs, 'lib', 'modules'))) \
+    # The modules directory carries the kernel's LOCALVERSION_AUTO hash,
+    # which does not reproduce across a re-patch of the same source; the
+    # kernel's identity is its pinned SRCREV and config (the @srcrev and
+    # @config entries above), so the hash is stripped from the name here.
+    platform['kernel_modules'] = sorted(re.sub(r'[+-]g[0-9a-f]{7,}$', '', n)
+                                        for n in os.listdir(os.path.join(rootfs, 'lib', 'modules'))) \
         if os.path.isdir(os.path.join(rootfs, 'lib', 'modules')) else []
     dtbs = {}
     for p in sorted(glob.glob(os.path.join(rootfs, 'boot', '**', '*.dtb'), recursive=True)):