fix: put-backs no longer name the untracked version.h (#145)

90c5c140 untracked v3/include/version.h, but six places still put it back
with git checkout. Git refuses the whole checkout when one path is unknown:

- scripts/nightly.sh images (set -e): the stage ended there, so the nightly
  (images, publish, proofs) and release.yml (images, docs, gitea-release)
  would fail. Acceptance does not run images, so it passed.
- scripts/check_images.sh (no -e), demo/build-iso.sh, demo/mint-zuse.sh
  (|| true): silently put nothing back, BLOCK_MAP.md and the SBOM included.
- scripts/qemu_session.py: an error after every boot, otherwise harmless.
- boards/BRINGUP.md: the step said to put it back.

BLOCK_MAP.md stays in every put-back: a signed build (CI's) still rewrites
its Signed column. Found while setting up alpha.5; Captain Bob: fix it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

boards/BRINGUP.md

@@ -144,8 +144,8 @@ make boot_image TARGET=MILKV  EMERGENCY_CONSOLE_ENABLED=1
       thumbdrive attached. After a clean build it does (tried on `MILKV`).
 - [ ] The Pi 5 build fetches the board's DTB once from the pinned firmware release; with no
       network, pass `RPI5_DTB=/path/to/bcm2712-rpi-5-b.dtb`.
-- [ ] Put back `v3/include/version.h` and `capsules/BLOCK_MAP.md` afterwards: the build
-      rewrites both.
+- [ ] Put back `capsules/BLOCK_MAP.md` afterwards if the build was signed: a signed build rewrites
+      its Signed column. (`v3/include/version.h` is untracked since 2026-11-11, #145.)
 
 ### 3.2 Rehearse each image as its own disk
 

demo/build-iso.sh

@@ -20,5 +20,5 @@ mformat -i "$tmp/efi.img" ::
 mmd     -i "$tmp/efi.img" ::/EFI ::/EFI/BOOT
 mcopy   -i "$tmp/efi.img" build/amd64/kernel/starkernel_loader.efi ::/EFI/BOOT/BOOTX64.EFI
 xorriso -as mkisofs -r -J -e efi.img -no-emul-boot -o "$out" "$tmp" 2>/dev/null
-git checkout -q -- capsules/BLOCK_MAP.md v3/include/version.h 2>/dev/null || true   # the build regenerates these
+git checkout -q -- capsules/BLOCK_MAP.md 2>/dev/null || true   # a signed build rewrites it; version.h is untracked (#145)
 echo "demo: $out"

demo/mint-zuse.sh

@@ -53,5 +53,5 @@ boot "Zuse: genesis minted onto attached thumbdrive" "fence marker write FAILED"
 boot "Zuse: identity confirmed from attached thumbdrive" "not recognized"
 make --no-print-directory -f kernel/Makefile ARCH=amd64 zusestick ZUSE_PAIR="$out"
 cp build/amd64/kernel/zusestick.img "$out/zusestick.img"
-git checkout -q -- capsules/BLOCK_MAP.md v3/include/version.h 2>/dev/null || true   # the build regenerates these
+git checkout -q -- capsules/BLOCK_MAP.md 2>/dev/null || true   # a signed build rewrites it; version.h is untracked (#145)
 echo "demo: Zuse minted -- $out/zusestick.img"

scripts/check_images.sh

@@ -178,7 +178,7 @@ check "a good format reads back" "$MKARTEMIS" --format "$T/t.img" --first-lba 20
 rm -f "$T/t.img"
 
 # the builds regenerate these; put them back as committed (as qemu_session.py does)
-git checkout -q -- v3/include/version.h capsules/BLOCK_MAP.md sbom.spdx sbom.spdx.json
+git checkout -q -- capsules/BLOCK_MAP.md sbom.spdx sbom.spdx.json      # version.h is untracked (#145)
 
 echo "RESULT: $([ $ok = 1 ] && echo PASS || echo FAIL)"
 [ $ok = 1 ]

scripts/nightly.sh

@@ -152,8 +152,9 @@ images)
         cp "build/boards/$2" "$OUT/$3"
     done
     # boot_image regenerates these (the source SBOM, and what qemu_session.py also puts back);
-    # the nightly does not change the tree
-    git checkout -q -- sbom.spdx sbom.spdx.json capsules/BLOCK_MAP.md v3/include/version.h
+    # the nightly does not change the tree. v3/include/version.h is untracked since 90c5c140 (#145):
+    # naming it here made git refuse the whole checkout, and set -e end the stage.
+    git checkout -q -- sbom.spdx sbom.spdx.json capsules/BLOCK_MAP.md
     (cd "$OUT" && rm -f pc-stick.img.xz raspi5.img.xz MilkV.img.xz &&
         sha256sum StarshipOS.iso pc-stick.img raspi5.img MilkV.img > SHA256SUMS)
     xz -T0 -6 "$OUT/pc-stick.img" "$OUT/raspi5.img" "$OUT/MilkV.img"

scripts/qemu_session.py

@@ -1125,6 +1125,6 @@ else:
 print(f"RESULT: {'PASS' if ok else 'FAIL'}", flush=True)
 if not globals().get("boot_done"):
     shutdown()
-for f in ("v3/include/version.h", "capsules/BLOCK_MAP.md"):
+for f in ("capsules/BLOCK_MAP.md",):          # a signed build rewrites its Signed column; version.h is untracked (#145)
     subprocess.run(["git", "checkout", "-q", "--", f], cwd=ROOT)
 sys.exit(0 if ok else 2)