Kernel release 6.18.38-rt-cuckoo+: reproducible build, guarded installer

Rebuilt with KBUILD_BUILD_USER/HOST/TIMESTAMP pinned. Without them the kernel
bakes the builder's user@hostname and wall-clock build time into /proc/version,
which publishes operator identity in a public artifact and makes the build
unreproducible. Pinned, anyone can rebuild and diff the bytes — the only trust
story available for an unsigned community kernel.

The installer refuses to run on anything but a Pi 4, refuses a mismatched
image/modules pair (vermagic failure means no /dev/pps0 on a kernel that
otherwise boots fine — silent and miserable to debug), verifies SHA256SUMS,
never touches kernel8.img, and leaves rollback as deleting one config.txt line.

Boot-tested on the Pi: Stratum 1, 273 ns offset, PPS handler confirmed NOT
threaded. Binaries ship as release assets, not in git.

kernel/build.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Reproducible RT kernel for the Cuckoo Escapement release.
+#
+# KBUILD_BUILD_{USER,HOST,TIMESTAMP} are the whole point of this rebuild: without
+# them the kernel bakes the builder's `user@hostname` and the wall-clock build
+# time into /proc/version, which (a) publishes operator identity and (b) makes
+# the artifact unreproducible. Pinning all three means anyone can rebuild this
+# and diff the bytes.
+set -euo pipefail
+cd "$HOME/src"
+
+PATCH="$(cd "$(dirname "$0")" && pwd)/0001-pps-gpio-keep-timestamp-in-hard-irq-under-PREEMPT_RT.patch"
+
+[ -d linux ] || git clone --depth=1 --branch rpi-6.18.y https://github.com/raspberrypi/linux
+cd linux
+
+export ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu-
+export KBUILD_BUILD_USER=cuckoo
+export KBUILD_BUILD_HOST=escapement
+export KBUILD_BUILD_TIMESTAMP='Mon Jan  1 00:00:00 UTC 2024'
+
+make bcm2711_defconfig
+./scripts/config --enable EXPERT --enable PREEMPT_RT \
+                 --set-str LOCALVERSION "-rt-cuckoo" --disable LOCALVERSION_AUTO
+make olddefconfig
+
+git apply --check "$PATCH" 2>/dev/null && git apply "$PATCH" && echo "PATCH APPLIED" \
+  || grep -q IRQF_NO_THREAD drivers/pps/clients/pps-gpio.c && echo "PATCH ALREADY PRESENT"
+
+grep -q "IRQF_NO_THREAD" drivers/pps/clients/pps-gpio.c || { echo "FATAL: patch missing"; exit 1; }
+
+make -j"$(nproc)" Image modules dtbs
+echo "BUILD OK: $(cat include/config/kernel.release)"