forgetest: the release acceptance tool and the bench diagnostics page

A stdlib-only daemon on the dev image (HTTP :8090) that runs the acceptance
catalog against the machine from a self-contained page, keeps the append-only
result log under /data/forgetest, and exports the release artifact the gate
reads. Tests declare kind (auto / operator / live), hardware (api / takeover),
coverage globs, prerequisites, and core membership; a test's domain
fingerprint is the hash of the manifest files its globs select plus the
platform and its own implementation, so a PASS stays valid exactly while
nothing it covers changed. Campaign rules: a FAIL ends the campaign, the core
(image health, kernel latch and drills, one live emission witness) is never
inherited, invalidate-all forces a full campaign, no SKIP. Live tests need the
operator acknowledgment and the physical arm press through the controller;
takeover tests stop forgectrl for the duration with a crash-recoverable
marker; the tool never touches the laser latch.

Catalog v1: 24 tests ported from the proven bench drills with their recorded
pass criteria (image, kernel K1-K3 and fire A/B/U, forgectrl API and logs,
motion incl. dead-man, cooling, live laser, camera, update, cloud). The bench
tab lists every scripts/bench tool and runs the board-side ones as
subprocesses (takeover tools wrapped). 44 host unit tests, including the gate
verification fixtures. Installed only by forgefirm-image-dev, with the bench
scripts under /usr/share/forgetest/bench.

scripts/bench/README.md

@@ -1,7 +1,13 @@
 # ForgeFIRM bench tools
 
 Hardware-verification tools for the ForgeFIRM bench. All run ON the
-target board (dev image, python3 present) unless noted. Host-side tools
+target board (dev image, python3 present) unless noted. The dev image
+installs them under `/usr/share/forgetest/bench/`, and the acceptance
+tool's **Bench diagnostics** tab (`http://<machine>:8090/#bench`,
+`docs/ACCEPTANCE.md`) runs the board-side ones with their arguments and
+the output on the page (takeover tools get forgectrl stopped and started
+around the run); the acceptance catalog itself is built from ports of
+these drills. Host-side tools
 take the machine address from `GF_HOST` (or `argv`, where stated); the
 ones that shell into the board over ssh use the `ssh` on `PATH`, or the
 client named by `GF_SSH` (for example `GF_SSH='wsl -d <distro> -- ssh'`