Audit follow-through: runbook, bench tools, recipes, release tooling

BRINGUP describes the present: the 54-test catalog and its seven-test
always core, the tier counts, the shipped low-temperature gates, the
density floor ($35 = 10), the two local core commits, the ffboot env
write, the aa-offset route, the current bench image, and the bench
measurements the audit asks for (pooled into the next session). The
workstation shell notes and every em dash are gone.

forgetest: the takeover waits for the cloud client too (found by its
command line); the unauthenticated /boot probe names the endpoint's
parameter; the UI prose is American English. Recipes: forgetest
fetches its package directory and init script only and drops
__pycache__ at unpack; the dev image no longer re-adds forgectrl; the
release image's remove list drops the gfui-client the BSP no longer
has; the platform identity strips the kernel's local-version hash
from the modules directory name, so a re-patched kernel keeps its
fingerprints. grblhal restart is stop then start. release.sh --dev
packs the dev image. fixture.sh refuses a readable env file.

Bench tools: the live-fire drills measure the lid-IR baseline before
every run and point at the fire-watch thresholds the engine reads;
one thermistor conversion (gfbench.degc) serves every drill; the six
dated measurement records leave the tool directory; feeder.c names the
two sysfs writes its caller makes.

Host tests: forgetest 258 pass; the coverage lint reports no uncovered
path across 54 tests. Acceptance: forgectrl.auth covers the /boot
probe; update.* cover ffboot and the manifest identity; the runbook
and bench-tool changes have no catalog consequence.

scripts/release.sh

@@ -10,7 +10,7 @@
 #                                      sign, checksums, stage, publish cmd
 #                                      (the acceptance gate reads
 #                                      releases/v<version>/acceptance.json)
-#   release.sh --dev                   build + pack a dev-signed .fw for
+#   release.sh --dev                   build + pack a dev-signed .fw of the dev image for
 #                                      the GUI upload path; no staging
 #
 # Environment:
@@ -89,6 +89,11 @@ if [ "$MODE" = "dev" ]; then
   KEY="${FORGEFIRM_DEV_KEY:?set FORGEFIRM_DEV_KEY to the dev signing key}"
   build_images
   resolve_ext4
+  # The dev archive carries the dev image (forgetest, the bench tools), not
+  # the release rootfs: what the panel's upload path installs on the bench
+  # is what the bench runs.
+  EXT4="${EXT4/forgefirm-image-glowforge/forgefirm-image-dev-glowforge}"
+  [ -f "$EXT4" ] || die "dev rootfs not found: $EXT4"
   check_size
   REL=$(sed -n 's/^FORGEFIRM_RELEASE ?= "\(.*\)"/\1/p' "$IMAGE_BB")
   DEVVER="v${REL}-dev-$(date +%Y%m%d%H%M%S)"