feat(kernel): drop firmware-less Wi-Fi, Bluetooth and GPU drivers; compress vmlinuz with zstd

[jeefy]

Follows #489 with the kernel-side half of the size review. −24 MB usr.raw, −4.3 MB per UKI vs current main; the trimmed image boots in just dogfood-check (Secure Boot, verity, lockdown=integrity, failed=0).

What

New patches/freedesktop-sdk/0009-linux-server-no-firmware-hw.patch, appended after 0007. The image ships no /usr/lib/firmware, so Wi-Fi (CFG80211/MAC80211 + every WLAN driver), BT, and DRM_AMDGPU/RADEON/NOUVEAU/XE cannot bind the hardware they drive; they are removed from the kernel config. KERNEL_GZIP → KERNEL_ZSTD. The kernel is already built off FSDK's cache because of 0006/0007, so this adds no new cache miss — but every full build after this PR rebuilds the kernel once (18 min locally).

The subtle part: FSDK's own config lines put ~190 of those drivers into its expected-configs check, which fails the build on any unset option. The patch snapshots which expected options are set, applies the removes + olddefconfig, and drops from the check exactly the options that went set→unset (192, printed in the build log) — everything else FSDK expects is still enforced. A stub-helper test proves only true dependents leave the check and an expected-but-missing option still fails.

Kept / not touched

DEBUG_INFO_BTF (Cilium CO-RE), RFKILL (x86 platform drivers), i915, simpledrm, virtio-gpu, hyperv_drm, vmwgfx, vboxvideo, ttm/gpu-sched. Sound (360 modules), media (212), IIO (127), input (73) are unchanged — that is the separate "M2" product decision. ast/mgag200/bochs were never built in this kernel, so there was nothing to keep. One side effect: cec.ko (HDMI-CEC, 40 KB) also drops because only amdgpu's display code selected CEC_CORE.

Removed: 201 module files / 23.9 MB (Wi-Fi 160 / 13.0 MB, amdgpu 6.1, xe 1.9, nouveau 1.3, radeon 0.9, Bluetooth 27 / 0.6). Added: libarc4.ko (5 KB; was built in via mac80211). Nouveau's absence makes nvidia-load's modprobe -r nouveau a no-op; docs and comments updated, code unchanged.

	v26.10.1215	main (local build of b3e4b0d)	this PR
usr.raw	215,330,816	211,357,696	187,297,792
disk UKI	93,467,568	79,671,296	75,356,672
.linux in UKI	20.7 MB gzip	20.7 MB gzip	16.4 MB zstd

Verification

0001/0006/0007/0008/0009 apply in order on a clean freedesktop-sdk-26.08.2 with no offsets; just validate; just export-image (kernel rebuilt; FSDK's expected-config check passed); just check-image vs both v26.10.1215 and main baselines; just dogfood-check passes; pytest 1501 (new test_kernel_no_firmware.py, patch-chain fixture extended, build-trigger case); ruff, docs-checks. patches/README.md row + bump-fsdk-version.md updated — this patch will need refreshing on FSDK bumps that touch fdsdk-config.sh's tail, same as 0006/0007. full-build added for CI's boot-test.

[github-actions]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

This change shrinks the server kernel by turning off drivers whose hardware can never work here (the image ships no firmware files) and by switching the kernel image to a tighter compression. The result is a smaller download and boot image. The kernel-config block does what the description says, and the trick for keeping the upstream "expected options" check honest is sound. One real problem: the compression switch is written for 64-bit Intel/AMD machines only, and it will break the kernel build on the 64-bit Arm target this project also declares. One shipped comment is now stale.

correctness

• enable KERNEL_ZSTD is unguarded and will fail the aarch64 kernel build. patches/freedesktop-sdk/0009-linux-server-no-firmware-hw.patch:59-60 run remove KERNEL_GZIP; enable KERNEL_ZSTD for every arch. FSDK's enable() (files/linux/config-utils.sh:26-29) appends the name to expected-configs unconditionally, and linux.bst:81-88 fails the build on x86_64|aarch64 when an expected option is unset. arm64 has no in-kernel decompressor: arch/arm64/Kconfig has zero HAVE_KERNEL_* selects, so the "Kernel compression mode" choice (init/Kconfig:305-308) is not visible and olddefconfig leaves KERNEL_ZSTD unset. The block's own filter cannot save it — it only strips options that went set→unset (patch line 62), and KERNEL_ZSTD was never set in was_set. Net effect on aarch64: Missing KERNEL_ZSTD and a failed build — the exact class of break that issue #377 hit and that 0007 guards with case "$arch" in x86_64) (and that FSDK itself uses for DRM_XE/DRM_I915, fdsdk-config.sh:666-670). aarch64 is declared in project.conf:18-20 but not built in CI today (docs/skills/architecture-roadmap.md:43), so this PR's checks stay green. Fix: wrap lines 59-60 in the same case "$arch" in x86_64) … ;; esac as 0007, and extend tests/unit/test_kernel_no_firmware.py with the arch-guard assertion test_kernel_watchdog.py:183-194 already uses.

docs-currency

• The PR says the nouveau "docs and comments" were updated, but files/nvidia/sysext/modprobe-nvidia.conf:1-3 (shipped in the sysext) still states "udev binds nouveau to the GPUs before that; nvidia-load.service evicts an already bound nouveau first", which is no longer true on the base kernel. tests/unit/test_nvidia_sysext.py:257-259 carries the same stale comment. Reword both like nvidia-load:6-13 did ("on a kernel that does build it…").

No findings from: security, intent-alignment, style.

Confidence: 3/5 (needs attention) — 1 medium finding; 2 perspectives requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

45caadf

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @jeefy, head 45caadfc9477) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • tests/unit/test_kernel_no_firmware.py

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

da6862f

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @jeefy, head da6862fe1f65) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • tests/unit/test_kernel_no_firmware.py

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.