commissioning: the layer, the acceptance tests, the harness rule, the docs, and the bench drills

meta-forgefirm: the forgefirm-users init replays the account at boot;
sshd refuses root and empty passwords and runs only while the panel
turns it on; the release image keeps an empty root password for the
console; the console banner; avahi announces forgefirm.local; https in
libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on
the rootfs; release.sh checks the root policy on the built rootfs.

forgetest: the commission suites (commission, commission_dark,
commission_sheet: 23 cases); the runner turns cloud mode on with the
typed phrase for a test that declares it; the baseline's motor_lock is
0; the log-export test checks the bundle for the camera key; the record
helpers write bytes as given and join the daemon's paths as POSIX. The
stream harness gains rule 24: a hold verdict is held again after a
resume. Bench drills: lens_travel.py and lens_stop_accel.py.

Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated
record.

meta-forgefirm/conf/distro/forgefirm.conf

@@ -8,6 +8,36 @@ DISTRO_FEATURES:remove = " \
   3g alsa avahi bluetooth bluez5 ext2 irda nfc nfs pci pcmcia \
   pulseaudio vulkan wayland x11 zeroconf "
 
+# mDNS: the image installs avahi-daemon by name (forgefirm-image.bb), so
+# the control panel answers at forgefirm.local. The avahi and zeroconf
+# features stay removed above: zeroconf would install
+# packagegroup-base-zeroconf (the daemon plus libnss-mdns), and avahi
+# would switch other recipes' avahi options on. The build is trimmed to
+# the daemon: no D-Bus (so no libavahi-client, no avahi-utils, no bus
+# activation; the daemon reads /etc/avahi/services itself), no GTK or Qt
+# front ends, no libdns_sd compatibility library, no libevent binding.
+# Python bindings are off in the recipe itself.
+PACKAGECONFIG:pn-avahi = ""
+# libnss-mdns is what avahi-daemon recommends: an NSS module so the
+# machine itself resolves .local names. Nothing on the machine does.
+BAD_RECOMMENDATIONS += "libnss-mdns"
+
+# TLS: forgectrl serves HTTPS on 443 with a self-signed certificate
+# through libmicrohttpd and ulfius, and links GnuTLS itself. GnuTLS is
+# trimmed to the library:
+#   no seccomp   the distro default adds libseccomp for the gnutls test
+#                programs; the library does not use it
+#   no libidn    internationalized host names in certificates; the
+#                machine's own certificate is plain ASCII (saves libidn2)
+#   no p11-kit   PKCS#11 tokens and the system trust store; the machine
+#                presents its own certificate and verifies no peer
+#                through GnuTLS (saves p11-kit and its modules)
+#   libtasn1     stays a shared library: the bundled copy is the same
+#                code without poky's CVE patches
+#   no tpm, fips, dane, and no certificate compression (brotli, zlib,
+#   zstd), none of which the panel uses
+PACKAGECONFIG:pn-gnutls = "libtasn1"
+
 # opengl stays: forgectrl's camera demosaic runs as GLES2 fragment
 # shaders on the GC880 (etnaviv), reached through surfaceless EGL with
 # no display stack. Mesa is trimmed to exactly that: the etnaviv