review: keep the scrubbed pin names, derive the manifest path, wrap a comment

Rebased onto main (0d0c846) and reviewed against the current packaging, image and release check
(#556, #563, #569):

- docs/releases.md conflicted on the pins table and the NPU paragraph: the branch put the private
  repositories' names back into a public file ("gpu-kernels (private, HIP)", "npu-kernels (private,
  signed)", "npu-runtime (private)"), which main had scrubbed. Resolved keeping main's wording
  ("private kernel add-on (HIP)", "private NPU kernel set (signed)", "private NPU runtime") and the
  new shape.
- scripts/weekly.sh package_checks: the set's manifest is now derived from `rel` once, instead of
  rebuilding the path with `${f%/npu/kernels/*}` plus `cut` (which can leave a double slash). Checked
  that the derived path resolves for <pkg>/npu/kernels/<set>/<id>/layer1.elf.
- os/mini/init.sh: comment wrapped.

Not marked ready: the package stage stages nothing against the pins in this tree (see the PR comment).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: bong-water-water-bong

os/mini/init.sh

@@ -94,8 +94,8 @@ else
     say "[engine] no /data/1bit-llama: '1bit serve' has no HRX llama-server on this boot"
 fi
 
-# The NPU kernels (each with its signed manifest) live on the stick (they used to be inside the RAM image, which made it too big
-# to load): link them to the path the engine looks for, beside itself.
+# The NPU kernels (each with its signed manifest) live on the stick - inside the RAM image they made it too
+# big to load - and are linked to the path the engine looks for, beside itself.
 if [ -d /data/npu/kernels ] && [ -d /home ]; then
     mkdir -p /home/bcloud/wt/npupkg-build/npu 2>/dev/null
     ln -sfn /data/npu/kernels /home/bcloud/wt/npupkg-build/npu/kernels 2>/dev/null

scripts/weekly.sh

@@ -341,13 +341,15 @@ package_checks() {  # package_checks <linux tarball>
     fi
     while IFS= read -r -d '' f; do
         rel=${f#"$t"/}
-        setdir=${f%/npu/kernels/*}/npu/kernels/$(echo "${rel#*/npu/kernels/}" | cut -d/ -f1)
         case "$(basename "$f")" in
             manifest|manifest.sig) continue ;;
         esac
+        # <pkg>/npu/kernels/<set>/<id>/layer1.elf -> the set's manifest, without rebuilding the path by hand
+        manifest=$t/${rel%/npu/kernels/*}/npu/kernels/${rel#*/npu/kernels/}
+        manifest=${manifest%/*/*}/manifest
         if [[ "$rel" =~ ^[^/]+/npu/kernels/[^/]+/([0-9a-f]+/layer1\.elf)$ ]]; then
             inner=${BASH_REMATCH[1]}
-            want=$(awk -v p="$inner" '$1=="file" && $4==p {print $2}' "$t/$setdir/manifest" 2>/dev/null)
+            want=$(awk -v p="$inner" '$1=="file" && $4==p {print $2}' "$manifest" 2>/dev/null)
             if [ -z "$want" ]; then
                 echo "FAIL $rel is not listed in its set's signed manifest"; nk=$((nk + 1))
             elif [ "$want" != "$(sha256sum "$f" | cut -d' ' -f1)" ]; then