commissioning: the layer, the acceptance tests, the harness rule, the docs, and the bench drills

meta-forgefirm: the forgefirm-users init replays the account at boot;
sshd refuses root and empty passwords and runs only while the panel
turns it on; the release image keeps an empty root password for the
console; the console banner; avahi announces forgefirm.local; https in
libmicrohttpd and ulfius; the panel on 80 and 443; the license bundle on
the rootfs; release.sh checks the root policy on the built rootfs.

forgetest: the commission suites (commission, commission_dark,
commission_sheet: 23 cases); the runner turns cloud mode on with the
typed phrase for a test that declares it; the baseline's motor_lock is
0; the log-export test checks the bundle for the camera key; the record
helpers write bytes as given and join the daemon's paths as POSIX. The
stream harness gains rule 24: a hold verdict is held again after a
resume. Bench drills: lens_travel.py and lens_stop_accel.py.

Docs: BRINGUP carries the present state; CAMPAIGN-LOG carries the dated
record.

scripts/bench/offset_probe.py

@@ -32,6 +32,9 @@ import sys
 import threading
 import time
 
+# forgectrl on the board (FORGECTRL_PORT overrides the port)
+BASE = 'http://127.0.0.1:%s' % (os.environ.get('FORGECTRL_PORT') or '80')
+
 SYSFS = '/sys/glowforge/'
 LEDS = '/sys/class/leds/'
 HZ = 25
@@ -225,9 +228,9 @@ def run_armed():
 
     def status():
         try:
-            with urllib.request.urlopen('http://127.0.0.1:8080/status', timeout=2) as r:
+            with urllib.request.urlopen(BASE + '/status', timeout=2) as r:
                 s = _json.load(r)
-            with urllib.request.urlopen('http://127.0.0.1:8080/cool/status', timeout=2) as r:
+            with urllib.request.urlopen(BASE + '/cool/status', timeout=2) as r:
                 c = _json.load(r)
             return {'t': time.time(), 'armed': c.get('armed'), 'phase': c.get('phase'),
                     'hv_enable': (s.get('switches') or {}).get('hv_enable'),