Add Phase 9 validation and advisory review

Record the finite dependency search, Wi-Fi maintenance blocker, and
pinned
icon provenance. Add bounded host orchestration and fixture coverage,
and
update release documentation with current evidence.

tests/admin_console_boundary/run.py

@@ -36,8 +36,25 @@ with tempfile.TemporaryDirectory(prefix="admin-console-boundary-") as directory:
                     "-o", str(path / "certificate")], check=True, timeout=30)
     subprocess.run([str(path / "certificate")], check=True, timeout=10)
     ssh = (ROOT / "src/ssh_transport.c").read_text()
-    adapter = ssh[ssh.index("static admin_ssh_console_token_t admin_console_token("):
-                  ssh.index("static void *ssh_malloc(")]
+    # Bound the adapter by its own functions, not the allocator helpers now
+    # owned by ssh_memory.c. Fail closed if the reviewed source layout changes.
+    adapter_markers = (
+        "static admin_ssh_console_token_t admin_console_token(",
+        "static void publish_slot(",
+        "static size_t admin_console_snapshot_index_locked(",
+        "static bool admin_console_is_current(",
+        "static bool admin_console_drained(",
+        "static esp_err_t admin_console_perform(",
+        "static const admin_console_owner_t s_admin_console_owner = {",
+        "static bool consume_external_close(",
+    )
+    positions = []
+    for marker in adapter_markers:
+        assert ssh.count(marker) == 1, f"SSH adapter marker missing/ambiguous: {marker}"
+        positions.append(ssh.index(marker))
+    assert positions == sorted(positions), "SSH adapter source order changed"
+    adapter_end = ssh.index("\n}", positions[-1]) + len("\n}")
+    adapter = ssh[positions[0]:adapter_end]
     unit = ((ROOT / "tests/admin_console_boundary/fakes.h").read_text()
             + strip_includes(header) + "\n" + strip_includes(source)
             + (ROOT / "tests/admin_console_boundary/adapter.c").read_text()