build: replace argument dispatch and retain source-bound verification

Replace argument recovery with direct build targets. Run host, target,
board, coverage, Miri and selected Kani checks while retaining source
identities, logs and artifacts, including failed attempts.

Keep the PID proof diagnostic exception explicit and match its exact
identity alongside passing contract assertions and covers.

Validation: final-source verification matrix, assembled workflow tests
and documentation build.

.github/workflows/firmware.yml

@@ -0,0 +1,41 @@
+name: Firmware gates
+
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_BUILD_JOBS: 2
+
+jobs:
+  verification:
+    name: Source-bound firmware verification
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install Nix
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31
+      - name: Fetch pinned dependencies
+        working-directory: firmware
+        run: nix develop .. -c cargo fetch --locked
+      - name: Install the coverage compiler and matching LLVM tools
+        run: nix develop -c rustup toolchain install nightly-2025-08-01 --profile minimal --component llvm-tools-preview
+      - name: Install manifest-pinned Miri and Kani tools
+        run: nix develop -c make verification-tools
+      - name: Host, target, board, coverage, Miri and Kani gates
+        run: nix develop -c make verification
+      - name: Retain verification evidence, including failed attempts
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: firmware-verification
+          path: |
+            firmware/target/verification/**
+            firmware/target/verification-tools/setup-*/*.log
+          if-no-files-found: warn