BRINGUP: the first pin-file campaign is done; pin the cloud client

The full acceptance campaign on dev image 20260821181036, the first built on
the <recipe>-pin.inc layout, satisfied 42 of 42 and its export authorizes a
release, so the status header, the acceptance section and item 12 describe
that rather than a campaign still owed; the catalog count is 42, not 35.
CAMPAIGN-LOG records the completion. Item 7 stops listing the cloud work the
campaign closed (the oversize live print, the progress bar watched from the
app, packaged-path cloud boot, the lid flash), records the operator's
declines (SPKI pinning, emulator parity, the ten-event pause machine) and the
reasoned memory guards, and item 19 no longer lists MCsn and PDfm as
unchecked: the client refuses both, so seventeen mandatory tags are dropped,
not nineteen.

forgefirm-app pin moves to b82d379 (python3-gfhardware): CLOUD.md and three
present-tense comments, no behavior change. No catalog consequence beyond the
pin bump itself, which the manifest scopes to the component.

docs/CAMPAIGN-LOG.md

@@ -3200,6 +3200,16 @@ controller's message. An operator watching the head come back has no such
 reference, and fifteen millimeters on a forty millimeter square reads as
 "back". The test stays as it is.
 
+## 2026-08-21: the first full campaign on a pin-file image
+
+Completed. Dev image `20260821181036`, the first built on the
+`<recipe>-pin.inc` layout: 42 of 42 satisfied (12 run on that image, 30
+inherited under the domain model from the day's earlier dev images), all
+eight `cloud.*` tests run on that image, and the export reads "Release authorized:
+YES" for that image's manifest (campaign `c-20260821182204-dc01`, exported
+2026-08-21T18:40:30Z, artifact sha256 `6f17f690...43273055`). No release is
+cut from it.
+
 ## Superseded status notes
 
 ### Shared machine services — remaining polish, as listed 2026-08-13