Harden SSH parsing and add notice tooling

- Enforce exact service and channel names with bounded failure parsing
- Add hash-pinned offline notice assembly and regression coverage
- Record advisory dispositions, provenance, integration evidence, and
  remaining gates

tests/release_notices/README.md

@@ -0,0 +1,17 @@
+# Release notice tool tests
+
+Run `python3 tests/release_notices/run.py` from the repository root. Uses Python's
+standard library and isolated temporary fixtures only; no managed package,
+SDK, toolchain, PlatformIO, network, or device is required. Linux/POSIX path and
+descriptor semantics match the notice tool.
+
+Covers exact full-text/excerpt preservation and manifests; deterministic bytes
+across moved roots/changed mtimes; missing, empty, changed and oversized inputs;
+source body drift outside excerpts; bounds/schema; traversal and symlinks in
+input/output ancestry; FIFOs/directories; existing user-data preservation;
+explicit output requirement; unlisted secret/config/build exclusion; incomplete
+write behavior; and success/failure CLI exits.
+
+Real installed-input assembly and recipient delivery are separate checks; see
+`docs/release_packaging.md`. Passing these tests is not license clearance or
+proof of corresponding-source compliance.