image: drop the python3 meta-package and the GnuTLS stack; pin forgectrl and grblHAL

The release rootfs carried python3-modules (tkinter, idle, 2to3, pydoc,
ensurepip, venv, asyncio, multiprocessing, xmlrpc) through the python3
meta-package, and libgnutls30, nettle, libgmp10, libunistring5 and
libtasn1 through libmicrohttpd (https) and ulfius (GnuTLS). Nothing on
the image uses either. Each Python recipe declares the module packages it
imports; forgetest declares its own, so the dev image carries no module
the release image lacks.

Pins: forgectrl 0e907f7db54b7a4c90b660f198d49e5c66b667b5 (armed shown from a
fresh report only, zero smoke phase for a dark session), grblhal-glowforge
fa9ed7834faab6f48367dc1ca5a5109b474f788d (rail enable only standalone).

BRINGUP: the lid IR lamp response measured over the full range; no camera
register file under /data; the rail policy and the cool status items
closed; laser.armed-kill stays in its domain; the debug-kernel drill
constraints.

Platform change (layer content): the full campaign is owed on the built
image.

meta-forgefirm/recipes-forgefirm/forgetest/forgetest.bb

@@ -25,7 +25,25 @@ inherit python3-dir update-rc.d forgefirm-manifest
 # it identifies the campaign, never a test fingerprint).
 FORGEFIRM_MANIFEST_SRC = "${WORKDIR}/forgetest/forgetest"
 
-RDEPENDS:${PN} = "python3 forgectrl"
+# The standard-library packages the tool imports (the page server, the
+# catalog, the bench scripts), not the python3 meta-package: the dev image
+# must carry no module the release image lacks, or a missing module in
+# the release rootfs would pass the campaign unseen.
+RDEPENDS:${PN} = " \
+    python3-core \
+    python3-compression \
+    python3-crypt \
+    python3-fcntl \
+    python3-io \
+    python3-json \
+    python3-logging \
+    python3-math \
+    python3-netclient \
+    python3-netserver \
+    python3-shell \
+    python3-statistics \
+    forgectrl \
+"
 
 INITSCRIPT_NAME = "forgetest"
 INITSCRIPT_PARAMS = "start 95 2 3 4 5 . stop 70 0 1 6 ."