commissioning: the layer, the acceptance tests, the harness rule, the docs, and the bench drills

meta-forgefirm: the forgefirm-users init replays the account at boot;
sshd refuses root and empty passwords and runs only while the panel
turns it on; the release image keeps an empty root password for the
console; the console banner; avahi announces forgefirm.local; https in
libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on
the rootfs; release.sh checks the root policy on the built rootfs.

forgetest: the commission suites (commission, commission_dark,
commission_sheet: 23 cases); the runner turns cloud mode on with the
typed phrase for a test that declares it; the baseline's motor_lock is
0; the log-export test checks the bundle for the camera key; the record
helpers write bytes as given and join the daemon's paths as POSIX. The
stream harness gains rule 24: a hold verdict is held again after a
resume. Bench drills: lens_travel.py and lens_stop_accel.py.

Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated
record.

scripts/bench/gfbench.py

@@ -18,7 +18,7 @@ degc(raw)      the factory B-equation coolant conversion
 data_path(f)   where a tool keeps its data files: FORGETEST_BENCH_DATA
                when set (the bench page passes <data>/bench/), else next
                to the tool.
-forgectrl_*    the machine-services HTTP API (:8080) with the panel token
+forgectrl_*    the machine-services HTTP API (:80) with the panel token
                from GF_TOKEN or, on the board, /data/forgefirm/panel.token.
 """
 import json
@@ -90,7 +90,7 @@ def data_path(name):
 # ------------------------------------------------------------- forgectrl
 
 def forgectrl_base():
-    return os.environ.get("FORGECTRL_URL") or "http://%s:8080" % HOST
+    return os.environ.get("FORGECTRL_URL") or "http://%s:%s" % (HOST, os.environ.get("FORGECTRL_PORT") or "80")
 
 
 def token():