[boburning]

Summary

• add an explicit X/confirm flow for forgetting a saved inactive Wi-Fi profile
• reject the projected active profile before spawning and retain the private store's independent active-profile refusal
• execute one fixed-argv, nonblocking bloomctl network forget ID request with a 4 KiB output ceiling and exact schema-1 delete acknowledgement
• reload the credential-free profile projection after every terminal or cancellation path because publication may precede acknowledgement
• reset terminal scan presentation when reopening Wi-Fi so the saved-profile surface is reachable again
• change request teardown to send TERM and allow a bounded service cleanup window before forced process-group KILL, preventing abandoned lock/incoming artifacts
• record PR feat(shell): render guarded Wi-Fi profile save form #554's green merge evidence and update architecture/security/test documentation

Dependency and scope

Base: current main at 736b25dcda4502ee6342f267309a8ec7d16a001b (PR #554 merged).

This continues NET-05 in #544. It adds no profile projection, network association, radio mutation, DHCP restart, listener reconciliation, reboot, update, or device action.

The next association step is intentionally not included: the canonical transaction currently requires a developer recovery gate, carries a one-time nonce, and requires fresh host-key-verified SSH confirmation. This PR does not auto-confirm or weaken that rollback contract.

Validation

• formatting dry-run on all changed C/C++ files
• strict -std=gnu18 -Wall -Wextra -Werror compiles for main.c and bloom_shell_wifi_ui.c
• exact affected shell selector: 106/106 passed
  • legacy manifest, provenance, transfer policy, and dependency inventory each ran exactly once and passed
• native exact affected scope: 190/190 passed
• AddressSanitizer exact affected scope: 190/190 passed with leak detection and halt-on-error
• typography authority: Bloom typography validate: 4 candidates, 7 roles, 1 MiB cache
• risk-scoped cppcheck closure: src/bloomUi src/bloomShell completed with exit 0 (known informational/style findings only)
• JSON authorities parse successfully
• git diff --check
• CI scope: risk 2, build bloomShell, no visual-gallery gate

The new unit coverage verifies fixed arguments, exact acknowledgement parsing, credential-bearing response rejection, active-profile refusal, bounded nonblocking polling, cancellation, and observed TERM cleanup before fallback kill.

Device evidence

No candidate was deployed and no SSH, Wi-Fi, profile, radio, listener, reboot, or update mutation was performed. The Mini Plus remained on the known-good signed baseline, online and associated, throughout this host-only slice.

Limitations

• forgetting the active/projected profile is deliberately unavailable
• saving or forgetting a profile does not connect to another network
• association/rollback, physical controls, framebuffer presentation, and Mini V1-V4 / Mini Flip behavior were not tested here
• this PR makes no physical certification claim

Closes no issue; continues #544 under parent #434.

Live CI

Current head e8f59a9b passed all required checks:

• format: 17 seconds
• focused shell integration: 52 seconds
• AddressSanitizer: 1 minute 20 seconds
• affected ARM build: 1 minute 24 seconds
• native tests: 1 minute 34 seconds
• risk-scoped static analysis: 2 minutes 25 seconds