Catalog: setup.account-login, motion.cancel-abort, forgectrl.settings-bounds and exthost.service leave; the rootfs lint takes image.health's file checks

The catalog is 43. Each test leaves for a host proof that its
component's CI runs at the pins:

- setup.account-login: the login rules are host_routes.sh's (forgectrl
  6c2bb38); the render is test_image.py's new AccountRenderTests, which
  runs the layer's forgefirm-users.init with reload in a private mount
  namespace as root (a fresh /run, the scratch account files over /etc,
  the scratch data directory, root's, over /data): the data directory
  found 0700 is 0711 after the render, and as the account's own uid the
  home is entered and written while listing the data directory and
  reading the users record are EACCES. A control without the script's
  chmod go+x fails it (700 != 711). forgectrl.auth's cover widens to
  src/ui/login.*, since login.html had no other cover.
- motion.cancel-abort: laser_lifecycle_test.py's new rule 17 on the
  null-sink controller: 0x85 stops a jog short of its target, Idle; ^X
  mid-move lands in Alarm with the position kept and no return to the
  job start; $X recovers to Idle and the next jog ships steps (counted
  in GFSINK_DUMP). It passes on the driver at its pin, badc832.
  motion.deadman requires motion.pacing in its place.
- forgectrl.settings-bounds: host_routes.sh refuses the out-of-range and
  over-length values with the settings file byte for byte the same, and
  the lid lamp under GF_SYSFS_ROOT follows lid_lamp_idle (forgectrl
  6c2bb38).
- exthost.service: forgeext's host tests at the pinned bb75b23 -
  sandbox_test (the confinement from inside, the pulse device, the
  settings file and the setup record refused), run_test.py (the API,
  safe mode, the master switch, and the killed host under the init
  script's own wrapper), install_test.py and sdk_test.py.
  exthost.armed-freeze requires exthost.platform in its place.

HOST_TESTED rows for each path the lint named once exthost.service
left: forgectrl src/logs.* to logs_test.c and
docs/advisories/extensions.md to host_setup.sh; forgeext src/api.*,
caps.*, evfeed.*, holdkeep.*, httpreq.*, manifest.*, quota.*,
sandbox.*, settings.*, state.* to their unit tests, netrules.* to
netrules_test.py, call.* to sdk_test.py, install.*, pkg.* and index.* to
install_test.py, and main.c, fflog.* and CMakeLists.txt to run_test.py.
test_manifest's behavioral-path case is unaffected.

The rootfs lint takes image.health's file checks (rules init-order,
logging, watchdog, read-only, dhcpv6, and on a release image factory),
each proved in RootfsLintTests by a drift that fails it. image.health
keeps the live half: the rendered issue and motd against the running
manifest, one host and no pool process, watchdog0, no userspace
watchdog running, the mounts, the dev image's factory slots read-only,
no DHCPv6 client running, the DHCP client's -b and parent, ifup, the
getty, and IPv6. release.sh drops its PermitRootLogin and
PermitEmptyPasswords greps, its ROOTFS_READ_ONLY check and its /factory
fstab check, which the lint holds; it keeps the empty root shadow
field, / mounted ro, and the three HostKey lines under /data.

setup.py registers no test now: its helpers the deleted tests alone
called go (tls_base, tcp_open, mode, press_status, wiz_summary,
wait_settled, the login constants), and test_setup_suite.py keeps the
cases of what remains.

Fingerprints: image.health's moves (its text), every test in
exthost.py, forgectrl.py and motion.py moves with its module text, and
the layer content hash moves with rootfs-lint.sh: the next image
inherits no campaign.

Proof: the coverage lint over the tree manifest from the pins finds 0
uncovered paths and 0 host-tested row problems (43 tests); pyflakes on
the touched files is clean; forgetest's unit suite under Linux passes
(334), test_image.py's 28 among them. The lint passes image
20261015142442's release tree as release and its dev tree as dev, and
refuses the dev tree as release (sshd, factory).
laser_lifecycle_test.py passes whole on the null-sink build of badc832.

scripts/release.sh

@@ -241,18 +241,14 @@ else
 fi
 
 # Root policy gate. The release image ships root WITHOUT a password (the
-# serial console is the recovery path) and sshd refuses root and empty
-# passwords: PermitRootLogin no and PermitEmptyPasswords no must be
-# active (uncommented) in the built sshd_config, and root's shadow field
-# must be empty. Read the built files, not the recipes: this catches a
-# drift however it got in (recipe, local.conf, an inherited class).
+# serial console is the recovery path): root's shadow field must be empty.
+# sshd's refusal of root and of empty passwords is the rootfs lint's
+# (meta-forgefirm/recipes-forgefirm/images/rootfs-lint.sh), which fails
+# the build. Read the built file, not the recipes: this catches a drift
+# however it got in (recipe, local.conf, an inherited class).
 SSHD_CONFIG=$(debugfs -R "cat /etc/ssh/sshd_config" "$EXT4" 2>/dev/null)
 [ -n "$SSHD_CONFIG" ] \
   || die "release rootfs carries no /etc/ssh/sshd_config"
-printf '%s\n' "$SSHD_CONFIG" | grep -Eq '^PermitRootLogin[[:space:]]+no[[:space:]]*$' \
-  || die "release sshd_config has no active 'PermitRootLogin no' (recipes-connectivity/openssh drift?)"
-printf '%s\n' "$SSHD_CONFIG" | grep -Eq '^PermitEmptyPasswords[[:space:]]+no[[:space:]]*$' \
-  || die "release sshd_config has no active 'PermitEmptyPasswords no' (recipes-connectivity/openssh drift?)"
 ROOT_SHADOW=$(debugfs -R "cat /etc/shadow" "$EXT4" 2>/dev/null \
               | awk -F: '$1=="root"{print; exit}')
 [ -n "$ROOT_SHADOW" ] \
@@ -260,27 +256,22 @@ ROOT_SHADOW=$(debugfs -R "cat /etc/shadow" "$EXT4" 2>/dev/null \
 ROOT_PW=$(printf '%s\n' "$ROOT_SHADOW" | awk -F: '{print $2}')
 [ -z "$ROOT_PW" ] \
   || die "release rootfs has a non-empty root password field: the policy is an empty field (empty-root-password in forgefirm-image.bb); a build drift"
-echo "root policy gate OK (root field empty; sshd refuses root and empty passwords)"
+echo "root policy gate OK (root field empty)"
 
 # Read-only rootfs gate. The release rootfs mounts read-only: the root
-# line of the built fstab carries ro, the rcS default agrees (the
-# read-only-rootfs image feature), no factory-slot mount is in the
-# release fstab (those belong to the dev image), and sshd keeps its host
-# keys on /data, where the read-only rootfs cannot hold them.
+# line of the built fstab carries ro, and sshd keeps its host keys on
+# /data, where the read-only rootfs cannot hold them. rcS's
+# ROOTFS_READ_ONLY and the fstab with no factory slot are the rootfs
+# lint's.
 FSTAB=$(debugfs -R "cat /etc/fstab" "$EXT4" 2>/dev/null)
 [ -n "$FSTAB" ] \
   || die "release rootfs carries no /etc/fstab"
 printf '%s\n' "$FSTAB" | awk '$1 == "/dev/root" && $2 == "/" { print $4 }' \
   | grep -Eq '(^|,)ro(,|$)' \
   || die "release fstab does not mount / read-only (base-files fstab or read-only-rootfs drift?)"
-printf '%s\n' "$FSTAB" | grep -Eq '^[^#]*[[:space:]]/factory/' \
-  && die "release fstab mounts a factory slot under /factory (dev image only)"
-RCS=$(debugfs -R "cat /etc/default/rcS" "$EXT4" 2>/dev/null)
-printf '%s\n' "$RCS" | grep -q '^ROOTFS_READ_ONLY=yes$' \
-  || die "release rcS has no ROOTFS_READ_ONLY=yes (read-only-rootfs image feature drift?)"
 [ "$(printf '%s\n' "$SSHD_CONFIG" | grep -c '^HostKey /data/forgefirm/ssh/')" = 3 ] \
   || die "release sshd_config does not keep the host keys under /data/forgefirm/ssh (recipes-connectivity/openssh drift?)"
-echo "read-only rootfs gate OK (/ ro, no /factory mounts, host keys on /data)"
+echo "read-only rootfs gate OK (/ ro, host keys on /data)"
 
 # Config-level guard: debug-tweaks must not sit in the shared kas config,
 # where it would apply to every target including the release image.