Trust: restamp gen-0 fingerprint after lowering drift (#10533)

[PurHur]

Summary

• Pillar 1: north-star5-verify-fast step 4f-m was red on master — lowering_source_fingerprint mismatch (manifest 61d833b8…, live 68b76910…).
• Restamp prelinked/bootstrap-gen0/manifest.json + .bootstrap_lowering_source.sha to the live fingerprint. Blob sha/size unchanged; provenance remains unverified-restamp (Gen-1+ #1492: committed gen-0 seed cannot be rebuilt — refresh OOMs at 48 GiB, 44 restamps since the blob last changed (script/bootstrap-refresh-gen0-sidecar.sh) #22642 OOM still blocks honest rebuild).
• Same pattern as Trust: restamp gen-0 fingerprint after lowering drift (#10533) #23419 / Trust: restamp gen-0 fingerprint after lowering drift (#10533) #23412.

Verification

$ php script/check-bootstrap-gen0-manifest-sync.php
check-bootstrap-gen0-manifest-sync: WARNING — manifest provenance=unverified-restamp …
check-bootstrap-gen0-manifest-sync: OK (… lowering_source_fingerprint=68b769100f2a…)

$ ./script/docker-exec.sh -- bash -lc 'make north-star5-verify-fast'
… step 4f-m ok (gen-0 manifest matches committed driver)
… north-star5-verify: OK (fast — use --strict before merging bootstrap/M5 work)

Pre-fix ./script/release-readiness.sh --json had user_release_ready: no solely from north-star5-fast step 4f-m.

Refs #10533 (pillar 1). (#10533 comments locked at 2500+.)

Made with Cursor