commissioning: the layer, the acceptance tests, the harness rule, the docs, and the bench drills

meta-forgefirm: the forgefirm-users init replays the account at boot;
sshd refuses root and empty passwords and runs only while the panel
turns it on; the release image keeps an empty root password for the
console; the console banner; avahi announces forgefirm.local; https in
libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on
the rootfs; release.sh checks the root policy on the built rootfs.

forgetest: the commission suites (commission, commission_dark,
commission_sheet: 23 cases); the runner turns cloud mode on with the
typed phrase for a test that declares it; the baseline's motor_lock is
0; the log-export test checks the bundle for the camera key; the record
helpers write bytes as given and join the daemon's paths as POSIX. The
stream harness gains rule 24: a hold verdict is held again after a
resume. Bench drills: lens_travel.py and lens_stop_accel.py.

Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated
record.

meta-forgefirm/recipes-extended/ulfius/ulfius_2.7.15.bb

@@ -23,12 +23,14 @@ S = "${WORKDIR}/git"
 inherit cmake pkgconfig
 
 # curl backs the default-ON WITH_CURL client-request API (find_package REQUIRED).
-DEPENDS = "jansson libmicrohttpd curl orcania yder"
+# GnuTLS backs the secure framework: forgectrl serves HTTPS on 443 with
+# a self-signed certificate.
+DEPENDS = "jansson libmicrohttpd curl orcania yder gnutls"
 
-# No systemd journald on the forgefirm image. forgectrl serves plain HTTP
-# and no websockets: no GnuTLS (which keeps nettle, gmp, libunistring and
-# libtasn1 off the rootfs) and no websocket support, which depends on it.
-EXTRA_OECMAKE += "-DWITH_JOURNALD=off -DWITH_GNUTLS=off -DWITH_WEBSOCKET=off"
+# No systemd journald on the forgefirm image. GnuTLS is on for HTTPS
+# (the trimmed GnuTLS build is set in conf/distro/forgefirm.conf); no
+# websocket support, which forgectrl does not use.
+EXTRA_OECMAKE += "-DWITH_JOURNALD=off -DWITH_GNUTLS=on -DWITH_WEBSOCKET=off"
 
 # ulfius builds itself with -Werror -Wconversion; under Yocto's arm32
 # time64 ABI (-D_TIME_BITS=64) a long-long-to-long time conversion in