Add laser-safety and regulatory documentation; scrub bench identity

- LIGHTBURN.md: mandatory "Before you cut" safety section; the
  walkthrough now reflects the firing machine (dry runs need the
  layer output off or M5; live first-cut instructions); the homing
  entry documents homing_mode and the gfcloud method; the machine
  address is a placeholder.
- README.md: condensed safety section linking the full text and the
  regulatory notes.
- INSTALL.md: "Regulatory and legal" section ahead of the install
  steps; routine updates route through the panel updater rather than
  the installer.
- BRINGUP.md: the release signing key is described as held offline
  (no on-disk path); bench address and credential notes removed;
  Next-work item 7 corrected (the installer embeds the production
  release key); status entry for audit remediation Phases 0-1; the
  GATE A kernel drills join the pending image-flash checklist.
- bench scripts: the target host comes from GF_HOST (or argv) instead
  of a hardcoded address.
- laser_stream_test.py: per-session controller runs with a hermetic
  cooling-verdict publisher; new assertions that every stream
  terminates with FIRE clear (including M3 held to stream end) and
  that no FIRE bit rides a zero-step gap; a cycle-churn session
  exercises the stop/start seams.

Audit findings D-1, D-2, D-3, D-5, D-10, D-12, B-10, and the harness
half of D-4/G-1.

INSTALL.md

@@ -30,6 +30,28 @@ software could seriously maim or kill you or others, and voids your
 warranty. It is not affiliated with or endorsed by Glowforge. Use it at
 your own risk.**
 
+## Regulatory and legal
+
+Installing ForgeFIRM replaces the firmware of a certified laser product.
+This is disclosure, not legal advice — but understand the categories
+before you install:
+
+- **Laser product certification (US).** The factory machine is
+  certified under FDA/CDRH 21 CFR 1040.10 and 1040.11. Modifying it
+  makes **you** the manufacturer of a modified laser product for
+  regulatory purposes; the original accession no longer describes the
+  article you operate.
+- **CE/UKCA (EU/UK).** The manufacturer's declaration of conformity no
+  longer covers the modified machine.
+- **Safety listing.** Any UL/ETL or equivalent listing applies to the
+  product as shipped, not as modified.
+- **Insurance.** Property and liability policies commonly exclude fire
+  loss involving modified equipment. Check yours before running jobs.
+
+The hardware safety interlocks (lid switches, interlock, power-fault
+chain) remain active under ForgeFIRM — but the regulatory status of the
+machine is yours to own once you flash it.
+
 ## Install
 
 Log in at the factory console and run:
@@ -75,9 +97,12 @@ Switch targets are probed first — `ffboot` refuses to select a slot
 that does not look bootable (`-f` overrides). Reverting to factory
 firmware and back requires no reinstall.
 
-To reinstall or update ForgeFIRM before the built-in updater ships:
-switch to factory firmware and run the installer again — it skips
-archives it already has and simply rewrites the ForgeFIRM slot.
+**Routine updates do not use the installer.** Update from the web
+control panel's System page, which downloads (or accepts an upload of)
+a signed `forgefirm.fw` release, verifies it, and applies it to the
+inactive slot. Rerunning the installer is only for recovering a broken
+ForgeFIRM install: switch to factory firmware and run it again — it
+skips archives it already has and simply rewrites the ForgeFIRM slot.
 
 ## Upgrading from a legacy dual-partition install