fix(myuplink): make the signed artifact agree that myuplink is read-only

[frahlg]

Carries #65 (@HuggeK) verbatim — same five commits, same authorship, same
tree. The only difference is a Signed-off-by trailer on the merge commit that
GitHub's "Update branch" button created without one, which failed the required
dco check on #65. That branch lives on a fork this session cannot push to, so
the fix is carried here instead. Credit for the change is HuggeK's; please close
#65 in favour of this.

Summary

myuplink declares read_only = true and auth_post_path = "/oauth/token" in
its DRIVER table. The signed channel infers control from the mere presence of
a driver_command entrypoint, so a driver whose entrypoint refuses every
command was still published control_enabled: true, read_only: false, with a
write permission. It now publishes read-only.

The read-only guard would otherwise deny host.http_post, which this driver
needs to exchange its refresh token before it can read anything. The generated
guard confines that POST to the declared path rather than trusting it, so the
flag enforces "this POST is authentication" instead of asserting it. A path
rather than a URL, because base_url is config-overridable.

The catalog-convention checks that lit up when this driver lost its
baselines/ftw byte-identity exemption are already handled on main: the
connectivity-aware test split stops holding cloud drivers to the local
config.host / config.port / http:// rules, and the driver contract accepts
host.emit_metric for metrics-only drivers.

Driver evidence

• Driver id: myuplink
• Device make/model: MyUplink cloud API (NIBE, Bosch, Atlantic, Daikin, ...)
• Firmware tested: not applicable — vendor cloud REST API, no device firmware
• Protocol/register source: MyUplink Cloud REST API v2, upstream_docs in the manifest
• Hardware test performed: none, and none is claimed — support status stays
  not_assessed for both targets. This is a read-only labelling and artifact
  correction, not a hardware claim.
• Known limits: the driver remains observe-only; driver_command still refuses
  every command it is handed.

Safety

• The driver starts read-only, or this is a separately reviewed control change.
• Vendor signs are converted at the driver boundary.
• Cached telemetry becomes stale instead of being re-emitted as fresh.
• No credentials, serial numbers, private addresses or site data are included.

The one write-capable permission this driver retains (http.post) is scoped by
the generated guard to the declared auth path.
test_signing_in_is_declared_or_it_does_not_happen fails if any driver other
than myuplink loses the blanket denial, and asserts every other read-only
driver has neither auth_post_path nor http.post.

Package or promotion evidence

• Public source SHA: 6074b70eb2bbe49481fcc59551d65474cb8129ae5370e9c1844c23b08a5f6fd6
• Package ID and new version: myuplink 1.1.1 → 1.2.0 (the Lua bytes moved;
  the DRIVER block's stale 1.0.0 version line is also corrected to match the
  manifest)
• Target matrix: ftw-core, blixt-l1 — both not_assessed, unchanged
• Material and candidate artifact SHA-256: as above; signed channel accepts this tree confirms the bump covers the changed bytes
• HIL evidence or required: not applicable — no control path
• Control enabled: false
• Control changes include default-mode, lease-expiry and HIL evidence. — not
  applicable; this removes a control claim rather than adding one.

Checks

• Commits include Signed-off-by. — all five verified
• make check — 3616 passed, 1333 skipped, on this exact tree

Channel note

A push to main publishes to the beta driver channel only
(.github/workflows/ftw-drivers-release.yml); promotion to drivers-stable
stays a manual workflow_dispatch. Sites on the stable driver channel are
unaffected, which is what makes this safe to land while ftw 1.16.x (carrying
RuntimePolicy.AuthPostPath) is still beta-only.

---

Generated by Claude Code