Support native SD storage and consolidate fds-flash tooling

Accept native SD cards for internal settings alongside legacy NVMe,
reject USB ancestry and ambiguous disks, and preserve read-only boot
loading with explicit recovery writes. Require built-in MMC drivers,
validate cached kernel configuration, and provide SD-only, SD-first and
USB-first EEPROM profiles.

Expose typed create and inspect commands through fds-flash, reuse the
existing cartridge creation code, and document the optional e2fsprogs
package dependency. Extend storage, EEPROM, flashing and hardware-test
coverage and advance the wiki reference to the published SD guide.

Validation: rootfs checks for CLI/development, boot matrix, internal
storage, EEPROM, flash, workstation, emulator, make check and wiki checks
passed. The full internal suite passed on an unchanged rerun after one
unexplained VM shutdown stall. Standalone init-test was blocked by its
unavailable pinned upstream kernel. Physical Pi checks remain pending.

tools/build-kernel

@@ -32,11 +32,20 @@ XBPS_ARCH=aarch64 xbps-rindex -fa "out/packages/$package"
 work=$(mktemp -d "$FDS_ROOT/out/kernel-build.XXXXXX")
 tar -xf "out/packages/$package" -C "$work"
 [[ -s $work/boot/kernel_2712.img && -s $work/boot/bcm2712-rpi-5-b.dtb ]] || die 'Missing Pi 5 kernel/DTB'
-# Preserve the existing mandatory display-protection requirement.
+# Reject stale packages missing any boot-critical or display-protection setting.
 while IFS= read -r setting; do
-    [[ $setting == CONFIG_*=* || $setting == '# CONFIG_'*' is not set' ]] || continue
-    grep -Fqx "$setting" "$work/boot/config-fds" || die "Dasung kernel requirement missing: $setting"
-done <image/kernel/dasung.config
+    case "$setting" in
+        CONFIG_*=*)
+            grep -Fqx "$setting" "$work/boot/config-fds" || die "Kernel requirement missing: $setting (rebuild with tools/build-kernel --rebuild)"
+            ;;
+        '# CONFIG_'*' is not set')
+            # Kconfig may omit disabled symbols whose dependencies are absent.
+            symbol=${setting#\# }
+            symbol=${symbol% is not set}
+            ! grep -Eq "^${symbol}=[ym]$" "$work/boot/config-fds" || die "Kernel requirement violated: $setting (rebuild with tools/build-kernel --rebuild)"
+            ;;
+    esac
+done < <(cat packages/fds-kernel/files/fds.config image/kernel/dasung.config)
 sha256sum "out/packages/$package" "$work/boot/kernel_2712.img" "$work/boot/bcm2712-rpi-5-b.dtb" >"$work/artifacts.sha256"
 cp "$work/artifacts.sha256" out/manifests/kernel-artifacts.sha256
 cp "$inputs" "$work/build-inputs.sha256"

tools/clean-builds

@@ -17,7 +17,7 @@ import sys
 PREFIXES = (
     'rootfs-build', 'kernel-build', 'system-build', 'initramfs-build',
     'boot-build', 'recovery-build', 'internal-build',
-    'eeprom-production', 'eeprom-development',
+    'eeprom-production', 'eeprom-development', 'eeprom-maintenance',
     'cartridged-source', 'init-source', 'dasung-services', 'dasung-s6',
     'rust-notices', 'verify-package', 'dasung-check', 'dasung-s6-run',
     'm1-checks', 'm2-vm', 'm4-vm', 'm5-vm', 'm6-vm', 'm7-vm', 'm8-vm',

tools/configure-pi-eeprom

@@ -36,7 +36,7 @@ def merge(original,profile):
 
 def main():
     parser=argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--profile',choices=['production','development'],default='production')
+    parser.add_argument('--profile',choices=['production','development','maintenance'],default='production')
     parser.add_argument('--base-image',type=Path,help='Regular-file Pi 5 EEPROM image; defaults to the pinned preview firmware')
     parser.add_argument('--current-config',type=Path,help='Saved board configuration to preserve instead of the image defaults')
     parser.add_argument('--output-directory',type=Path,help='New directory; existing paths are refused')