Mount the rootfs read-only on both images

The rootfs mounted read-write, so a slot ran with its own files open to
change, and the factory-slot mounts rode along on the release image.
Both images now carry the read-only-rootfs feature: the ro root line and
the rcS default, the volatile links made at rootfs time, a writable copy
of /var/lib at boot, a build failure for a post-install that needs the
machine, and the removal of shadow, base-passwd, update-rc.d and
update-alternatives.

What must last or change at run time is handled file by file:

- forgefirm-users renders the four account files from the record into
  /run/forgefirm/accounts and bind-mounts each copy over its /etc file
  (useradd and the rest are gone with shadow); a render writes through
  the mount, and the image's own files apply until the first render.
- forgefirm-banner bind-mounts a copy of /etc/issue and writes the
  address block through it.
- sshd keeps its host keys under /data/forgefirm/ssh, so the fingerprint
  survives updates; both sshd configs carry the same HostKey lines.
- forgefirm-logging passes logrotate a state file under /var/run
  (logrotate refuses to run without one).
- forgefirm-persist points the boot timestamp and the random seed at
  /data/forgefirm.

The dev image appends the /factory slot mounts, without nofail (busybox
mount hands it to the kernel, which rejects it). The rootfs command
entries lose their semicolons: on scarthgap the value is the task's
vardeps, split on whitespace, so "name;" left the function body out of
the signature and a changed body did not remake the rootfs; with the
bodies tracked, the dev image's DATETIME string needs a vardepsexclude.
release.sh gains the read-only gate (root ro, no /factory line,
ROOTFS_READ_ONLY=yes, host keys on /data). image.health checks the
mounts, the account binds, the banner bind, the host keys and the
dev-only /factory mounts.

Proven on the bench reference (dev image 20260909140901): / ro, /data
rw, /var/lib a tmpfs copy, the four account files and /etc/issue bound
from tmpfs, the host keys in /data/forgefirm/ssh, no "Read-only file
system" line in any log; forgectrl.auth and commission.account-login (a
temporary account rendered, logged in over HTTPS and removed again),
kernel.latch-locked-idle and motion.liveness-probe PASS; logrotate runs
with the volatile state. forgetest unit tests 335 OK; both images build
clean, and debugfs on the built rootfs shows every setting above.

meta-forgefirm/recipes-forgefirm/forgefirm-persist/files/timestamp

@@ -0,0 +1,6 @@
+# /etc/default/timestamp - ForgeFIRM
+# The last-known time: save-rtc.sh writes it at shutdown, bootmisc.sh
+# sets the clock from it at boot when it is later than the clock (the
+# board has no battery-backed RTC). The rootfs is read-only, so the file
+# lives with the machine state on /data.
+TIMESTAMP_FILE=/data/forgefirm/timestamp

meta-forgefirm/recipes-forgefirm/forgefirm-persist/files/urandom

@@ -0,0 +1,5 @@
+# /etc/default/urandom - ForgeFIRM
+# The random seed the urandom init script carries from shutdown to the
+# next boot. The rootfs is read-only, so the file lives with the machine
+# state on /data.
+RANDOM_SEED_FILE=/data/forgefirm/random-seed

meta-forgefirm/recipes-forgefirm/forgefirm-persist/forgefirm-persist.bb

@@ -0,0 +1,23 @@
+SUMMARY = "ForgeFIRM boot state on /data: the timestamp and the random seed"
+DESCRIPTION = "The two files the poky init scripts keep across boots, \
+pointed at /data/forgefirm because the rootfs is read-only: the boot \
+timestamp (bootmisc.sh restores it, save-rtc.sh writes it at shutdown; \
+the board has no battery-backed RTC) and the random seed (the urandom \
+script carries it from shutdown to the next boot)."
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+SRC_URI = " \
+    file://timestamp \
+    file://urandom \
+"
+
+S = "${WORKDIR}"
+
+# The scripts that read these defaults.
+RDEPENDS:${PN} = "initscripts"
+
+do_install() {
+    install -Dm 0644 ${WORKDIR}/timestamp ${D}${sysconfdir}/default/timestamp
+    install -Dm 0644 ${WORKDIR}/urandom ${D}${sysconfdir}/default/urandom
+}