Productionize DeckDoc Rescue as a verifiable outside-OS collector

[deucebucket]

Current prototype

This branch adds a read-only Rescue collector and an unsigned rolling ArchISO builder. It uses systemd's image reader for installed journals and does not present itself as Valve recovery media.

Remaining scope

Turn the prototype into a pinned, reproducible, signed, boot-tested release with a safe docked-Ethernet support path.

Acceptance criteria

• Pin the base, packages, kernel, build container/toolchain, and source revision.
• Publish reproducible build instructions, checksums, signatures, SBOM, and provenance.
• Boot-test USB media on Jupiter LCD and Galileo OLED with controls, display, storage, USB-C, and network checks.
• Keep the installed disk read-only; test LUKS, BTRFS, ext4, dual-slot, damaged, and missing-disk cases.
• Collect live hardware plus installed current/previous boot evidence and an access ledger.
• Provide authenticated docked-Ethernet transfer/support instructions; SSH is off until the user explicitly enables it.
• Detect and warn before any operation that could mount read-write, repair, unlock, or alter firmware.
• Ensure archives are private, checksummed, redaction-ready, and easy to copy before shutdown.

Non-goals

It is not a Valve recovery image, an automatic repair environment, a firmware flasher, or a USB-C gadget claim. Direct USB gadget transport stays capability-gated until hardware/UDC support is proven.

Docs

bootprobe/README.md and docs/wiki/DeckDoc-Rescue.md