[boburning]

Summary

• removes the inherited unauthenticated-root Telnet environment launcher and dormant start path from newly assembled stable payloads
• removes Telnet state plumbing and the visible Tweaks toggle, so the UI no longer advertises a listener BloomOS refuses
• removes current website enablement instructions and links while preserving versioned Onion 4.2 historical documentation
• preserves stale .telnetState migration cleanup, exact BusyBox telnetd detection/termination, standalone telnetd cleanup, and fail-closed legacy entrypoints for older cards
• updates the exhaustive inventory, dependency lock, CI scoping, regression tests, security guidance, and 1.0 matrix

This is a host-safe NET-10 slice and closes #623. It is based directly on current upstream main at 9bda626 and has no stacked PR dependency.

Exact delta

• one 653-byte stable Telnet launcher removed
• stable inherited inventory reduced by one file and 1,804 bytes after the dormant start code was also removed
• stable inventory: 333 components, 1,974 files, 261,292,177 bytes
• source-build components: 232
• unresolved inherited components: 101

Validation

• affected Shell suites: 79/79 passed in 112.25 seconds after one manifest/provenance/dependency preflight
• exhaustive Shell suite: 811/811 passed across 8 shards in 153.78 seconds, no retry
• documentation-amended listener suite: 7/7 passed in 38.66 seconds
• RetroArch build-identity tests: 3/3 passed in 1.062 seconds
• scoped cppcheck 2.19 for src/tweaks: completed in 1.15 seconds
• pinned Miyoo ARM toolchain compiled the affected Tweaks consumer as a stripped 32-bit ARM EABI5 executable; SHA-256 a9688c822c339f08c64b19a3dfc927a39ba23e53b4371000100155f53c7f4e53
• POSIX shell syntax and Git diff checks passed
• task-created ARM/cppcheck outputs and temporary containers were removed after evidence capture

The complete ARM packaging gate and Docusaurus build are delegated to their required repository checks. Stable-payload removal remains full-build/full-Shell scoped; cppcheck stays limited to the actual Tweaks C consumer.

Device evidence and limitations

• no device deployment, Wi-Fi/profile/listener mutation, reboot, input injection, ROM/Save access, overlay change, or signed-update mutation was performed
• the Mini Plus remains on its prior signed baseline with the existing DISP-04 Bloom Shell overlay preserved
• a previous read-only audit of that older installed baseline observed inherited BusyBox Telnet on port 23; this PR does not claim the old installation has been remediated
• NET-10 remains in progress until a coherent signed Full candidate verifies the retired payload, listener lockdown, rollback, and Wi-Fi stability without recreating the prior rollback loop
• remote evidence does not certify physical controls, LCD, audio, gameplay, save semantics, or power behavior