Keep debug-tweaks out of release images; harden the installer

- Move the passwordless-root debug-tweaks image feature out of the
  shared kas config into forgefirm-image-dev.bb, so the release
  forgefirm-image built from the same config is not passwordless-root.
  release.sh gains a gate that reads the built rootfs /etc/shadow and
  fails on an empty root password, plus a config-level guard that
  debug-tweaks is not present in the resolved kas dump. (B-1)
- The installer copies ffboot out of the signature-verified new rootfs
  it already mounts, instead of fetching and executing it from a mutable
  GitHub raw ref. (B-2)
- Record audit remediation Phase 2 (GATE B) status in BRINGUP.md,
  including the bench pass still required to close the gate.

kas/forgefirm-glowforge.yml

@@ -115,12 +115,11 @@ local_conf_header:
     PREFERRED_PROVIDER_virtual/kernel = "linux-fslc"
     PREFERRED_VERSION_linux-fslc = "6.12%"
 
-  # Development image features. debug-tweaks gives a passwordless root login for
-  # bench bring-up; kas generates its own local.conf (it does NOT inherit poky's
-  # local.conf.sample), so this must be set explicitly. Drop it (and set a real
-  # root password via extrausers) before any production/field image.
-  image-debug: |
-    EXTRA_IMAGE_FEATURES = "debug-tweaks"
+  # NOTE: debug-tweaks (passwordless root) is deliberately NOT set here. It
+  # would apply to every target built from this config, including the release
+  # forgefirm-image. It lives in forgefirm-image-dev.bb's IMAGE_FEATURES so a
+  # single build yields a hardened release image and a debug dev image.
+  # release.sh gates the release rootfs against a passwordless root entry.
 
   build-tweaks: |
     # Parallelism for the 12-core / 16 GB WSL2 VM. (The earlier mid-build deaths