fleet/ohm: import Patch I (5GHz scan filter) + arm64 SCS build-fix

Patch I closes besser#1 — the wsm_generic_confirm 0x0007 dmesg storm.
One-line guard in bes2600_hw_scan() refuses the 5 GHz iteration of
mac80211's per-band hw_scan loop with -EOPNOTSUPP, so the firmware
never sees the scan request that would be rejected with status 2 →
-EINVAL cascade.  Phase 7 verified 2026-05-18 on ohm running pkgrel=2:
Pattern A 14.3/h → 0/h over 30-min window, no WARN/BUG, single-band
2.4 GHz scans still return BSSes cleanly.

Two flavors imported (scan-filter-5ghz and scan-filter-5ghz-danctnix)
matching the convention of other bes2600 series — the code path
doesn't touch timer APIs so the two are byte-identical for now;
flavor separation is kept to preserve consistency in ohm.yaml.

The arm64 scs-arm-neon-build-fix series is a build-environment
workaround: GCC 15.2.1 strictly validates that -fsanitize=shadow-
call-stack requires -ffixed-x18, and arm_neon.h's #pragma target/
push/pop blocks lose x18 fixing inside the wrapped section.  The
Makefile tweak re-adds -ffixed-x18 explicitly for xor-neon.o.  It's
a no-op when SCS is off (current pkgrel=2 ohm config) and unblocks
SCS=y once GCC upstream is fixed.

ohm.yaml gains a CONFIG_SHADOW_CALL_STACK=n config override with a
pointer to besser#20 (the re-enable tracking issue) so future
manifest-driven kconfig generation honors the workaround without
silently dropping it.

Source-of-truth commit for Patch I:
  marfrit/bes2600-dkms branch bes2600/scan-filter-5ghz sha 093a503
PKGBUILD-side (already deployed to ohm via pkgrel=2):
  marfrit/besser branch claude-noether-14 sha ae175f9

Refs: besser#1 (closed), besser#20, kernel-agent#5

fleet/ohm.yaml

@@ -55,6 +55,18 @@ includes:
   - driver/bes2600/drop-orphan-file-io-danctnix/
   - driver/bes2600/remove-chardev-user-interface/
   - driver/bes2600/enable-testmode/
+  # Patch I — besser#1 closure. Filter 5 GHz scan iteration at the
+  # driver boundary (refuses 5 GHz drv_hw_scan with -EOPNOTSUPP).
+  # Eliminates the wsm_generic_confirm 0x0007 dmesg storm.
+  # Phase 7 verified 2026-05-18: Pattern A 14.3/h → 0/h.
+  - driver/bes2600/scan-filter-5ghz-danctnix/
+
+  # Build-environment workaround for GCC 15.2.1 + CONFIG_SHADOW_CALL_STACK=y
+  # + arm_neon.h #pragma pop_options interaction. See besser#20 for the
+  # re-enable-once-GCC-fixed tracking; for now we ship with SCS=n in the
+  # config and this Makefile tweak as belt-and-suspenders (no-op if SCS
+  # is off; allows SCS=on once GCC permits). Cross-arch fix, not bes2600.
+  - arch/arm64/scs-arm-neon-build-fix/
 
 # Explicitly NOT included (decision logged):
 #   - debian-copyright-fsf-address: Debian packaging metadata, not kernel
@@ -64,6 +76,12 @@ config:
   source: hand-managed config file in boltzmann:~/src/besser/marfrit-besser/danctnix-besser-pkgbuild/kernel/config
   strategy: snapshot, fold to baseline, accept-new with rationale on diff
   TODO: migrate config into kernel-agent flow once kconfig-by-manifest lands
+  # Override applied for pkgrel=2 (2026-05-18): CONFIG_SHADOW_CALL_STACK=n
+  # to work around GCC 15.2.1 arm_neon.h pragma issue. Track besser#20
+  # for re-enable plan. Flip back to =y in the manifest once verified
+  # to build clean on current Arch ARM GCC.
+  overrides:
+    CONFIG_SHADOW_CALL_STACK: n  # WORKAROUND besser#20 — restore to y when GCC is fixed
 
 package:
   name: linux-pinetab2-danctnix-besser