bin/ka-promote: implement resolver + cumulative + manifest.lock (Phase 6 of #22)

First of the three [ka:cli-build-out] verbs (umbrella #21). Reads
fleet/<host>.yaml, resolves includes[] (single-file + series-dir),
concatenates in apply order, emits build/<host>/<ref>/{cumulative.patch,
manifest.lock}. Phase-3 ground truth on fresnel parity: b2sum
4d9d93c655ea701b… matches bit-for-bit.

Five tests in tests/ka-promote/ (fresnel parity, series-dir resolver,
bad-include, missing-patch, dup-include) all pass.

Validator (--validate-against <linux-checkout>) hard-fails on: missing
.git, baseline.ref not in checkout, HEAD-tree != baseline.ref tree,
or uncommitted/untracked changes. Verified on boltzmann against the
torvalds v7.0 worktree (all 3 negative paths exit 3 with clear errors).

Side fix: fleet/fresnel.yaml baseline.tree mmind/linux-rockchip → torvalds/linux.
mmind doesn't ship a plain v7.0 tag; baseline was actually torvalds the
whole time. mmind kept as informational patch_authoring_context.

Phase-5 reviewer (sonnet outside-look, #22 comment 1135) followups
addressed: series-dir fixture count 7 (not 6), divergence = hard error,
raw-bytes manifest hash, duplicate-include pre-flight check, explicit
yaml.dump(sort_keys=True).

Language choice (vs ka-status's bash): pure python3 — YAML round-trip,
dict construction, and per-file hashing made bash+heredoc python quoting
hell with no readability gain.

Phase 7 (verify on ampere parity) + Phase 8 (close + README rewrite +
PR) to follow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fleet/fresnel.yaml

@@ -1,9 +1,11 @@
 # kernel-agent manifest for fresnel (Pinebook Pro / Rockchip RK3399)
 #
-# Status: bootstrap, manually-driven. ka-* CLI not yet implemented.
-# This manifest is the input ka-promote / ka-build will consume once landed.
-# Until then it documents the canonical patch set + baseline for the manual
-# build that produces linux-fresnel-fourier.
+# Status: ka-promote-consumable. Used as Phase-3 parity reference for ka-promote
+# bring-up (issue #22). ka-build / ka-install CLI still pending.
+#
+# baseline.tree corrected 2026-05-18: mmind/linux-rockchip does not ship a
+# plain v7.0 tag; baseline is torvalds/linux v7.0. mmind kept as informational
+# patch_authoring_context.
 
 host: fresnel
 arch: arm64
@@ -12,10 +14,11 @@ board: pinebook-pro
 distro: archlinux-arm  # EndeavourOS pacman base
 
 baseline:
-  tree: mmind/linux-rockchip
-  url: https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip.git
+  tree: torvalds/linux
+  url: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
   ref: v7.0
   upstream_compat: linux-7.0  # what the patches target
+  patch_authoring_context: mmind/linux-rockchip  # informational — patches authored against Rockchip rebase
 
 # Scope-tagged patch includes. Each entry resolves to
 # patches/<scope>/.../<file>.patch in marfrit/kernel-agent.