Enforce crash-safe build policy

Add compile-time checks for silent reboot, disabled core dumps, and
disabled debugger-aware panic handling. Include regression coverage,
hardening guidance, and update Phase 8/9 project status.

src/CMakeLists.txt

@@ -6,6 +6,7 @@ idf_component_register(
         "network_console.c"
         "system_console.c"
         "secure_random.c"
+        "security_build_policy.c"
         "status_led.c"
         "local_display.c"
         "local_boot_animation.c"

src/security_build_policy.c

@@ -0,0 +1,30 @@
+#include "sdkconfig.h"
+
+/* Check resolved configuration, not just defaults: existing sdkconfig files
+ * survive default changes. Crash memory may contain credentials and UART data.
+ * See docs/security_hardening.md before changing this supported-build policy. */
+#if !defined(CONFIG_ESP_COREDUMP_ENABLE_TO_NONE) || !CONFIG_ESP_COREDUMP_ENABLE_TO_NONE
+#error "Security policy: select CONFIG_ESP_COREDUMP_ENABLE_TO_NONE=y"
+#endif
+
+#if CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH || CONFIG_ESP_COREDUMP_ENABLE_TO_UART || CONFIG_ESP_COREDUMP_ENABLE
+#error "Security policy: flash and UART core dumps must be disabled"
+#endif
+
+#if !defined(CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT) || !CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT
+#error "Security policy: select CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y"
+#endif
+
+#if CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT || CONFIG_ESP_SYSTEM_PANIC_PRINT_REBOOT || CONFIG_ESP_SYSTEM_PANIC_GDBSTUB
+#error "Security policy: panic register output and panic GDB stub must be disabled"
+#endif
+
+#if CONFIG_ESP_SYSTEM_GDBSTUB_RUNTIME
+#error "Security policy: runtime GDB stub must be disabled"
+#endif
+
+/* Prevent a connected debugger from replacing panic recovery with a halt.
+ * This is not a physical JTAG access restriction and does not change eFuses. */
+#if CONFIG_ESP_DEBUG_OCDAWARE || CONFIG_FREERTOS_DEBUG_OCDAWARE
+#error "Security policy: JTAG/OCD-aware panic handling must be disabled"
+#endif