commissioning: the layer, the acceptance tests, the harness rule, the docs, and the bench drills

meta-forgefirm: the forgefirm-users init replays the account at boot;
sshd refuses root and empty passwords and runs only while the panel
turns it on; the release image keeps an empty root password for the
console; the console banner; avahi announces forgefirm.local; https in
libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on
the rootfs; release.sh checks the root policy on the built rootfs.

forgetest: the commission suites (commission, commission_dark,
commission_sheet: 23 cases); the runner turns cloud mode on with the
typed phrase for a test that declares it; the baseline's motor_lock is
0; the log-export test checks the bundle for the camera key; the record
helpers write bytes as given and join the daemon's paths as POSIX. The
stream harness gains rule 24: a hold verdict is held again after a
resume. Bench drills: lens_travel.py and lens_stop_accel.py.

Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated
record.

meta-forgefirm/recipes-support/libmicrohttpd/libmicrohttpd_%.bbappend

@@ -1,3 +1,8 @@
-# forgectrl serves plain HTTP on the LAN: no TLS in the HTTP library, so
-# the rootfs carries no GnuTLS stack for it.
-PACKAGECONFIG:remove = "https"
+# forgectrl serves HTTPS on 443 with a self-signed certificate through
+# this library, so the https option (GnuTLS) is on; curl is the poky
+# default (it builds the library's own test client). libgcrypt is a
+# build-time dependency of the https option in the poky recipe;
+# libmicrohttpd links it only for a GnuTLS older than 2.12, so it does
+# not reach the rootfs. The GnuTLS build options are in
+# conf/distro/forgefirm.conf.
+PACKAGECONFIG = "curl https"