v0.3: Kconfig-aware configurator + downloadable defconfig fragment

[widgetii]

Summary

Builds on v0.2's build-time aggregator — same architecture (browser fetches
same-origin only), no new infra, no new files on `OpenIPC/firmware`'s or
`OpenIPC/builder`'s gh-pages. Adds a real "Configure" tab that lets users
tick packages to remove, computes the cascade closure with Kconfig
semantics, and exports a defconfig fragment to append to a board defconfig.

Pairs with OpenIPC/firmware PR for the kconfig-graph emitter. Until
that PR lands and one nightly cycle attaches the assets to release tags,
this PR's prebuild logs "no kconfig assets found in any retained tag"
and the Configure tab stays disabled with a tooltip — `kconfig_available_for`
ends up empty and the gate at `App.tsx` blocks click. By design, not
a bug.

Data path

`scripts/prebuild.mts` now also downloads `kconfig-*.json` from the
most recent nightly tag once per source (graph evolves slowly; per-build
storage isn't worth ~3 GB raw across the retention window). Files land
at:

```
public/data//kconfig/kconfig-graph..json
public/data//kconfig/kconfig-help..json
```

`IndexFile` gains a forward-compatible `kconfig_available_for?: string[]`
field at the source level. Empty / absent → no graph data shipped yet;
populated → the Configure tab works for these platforms. `IndexFile.schema`
stays at 1 — older v0.2-era files (no field) keep parsing without error.
`tests/types-compat.test.ts` covers this.

Dep closure semantics

`src/lib/kconfig.ts` is pure. `closeDisable` iterates to fixed point:

1. Each pass extends the disabled set with symbols newly disable-able.
2. A symbol can be disabled only if no still-set ∧ not-in-our-disable-set
   symbol hard-`select`s it. If something still selects it, the disable
   is blocked and the UI explains which symbol is pinning it on.
3. After the initial sweep, re-checks blocked entries: a symbol previously
   blocked may unblock as its selectors fall in the cascade.

This matches Kconfig's actual save behaviour — telling Kconfig "drop X"
when something still selects X is a silent no-op. The configurator surfaces
the blocker so the user can choose to drop the selector instead.

`defconfigFragment` renders a deterministic, sorted, known-symbol-only
set of `# BR2_PACKAGE_FOO is not set` lines. URL-injected ghost symbols
are filtered at output time.

WhatIfPanel

• Per-symbol checkbox.
• Status badge column: `kept` / `would-disable` / `blocked`.
• Pinned-by column: chips listing the still-enabled hard-selectors for blocked entries.
• KPI summary: disabled count, blocked count, real rootfs savings via `sizes.json`'s per-package bytes against the disabled closure's package set (no more naive-sum disclaimer the v0.1 stub had), new-headroom projection.
• "Download defconfig fragment" → `Blob` → `<a download="...">` click. No server round-trip.
• Help text loads lazily via per-symbol popover on row-label click; missing help is non-fatal.

Bundle invariant extended

`tests/bundle.test.ts` gains the assertion that JS chunks never embed
`releases/download/...kconfig...` URLs. Same regression-guard pattern
that catches the original CORS bug class.

Numbers

	v0.2 (shipped)	v0.3 (this PR)
Active tests	38	46 (+10 kconfig, +3 types-compat)
JS bundle	166 KB / 53 KB gz	172 KB / 55 KB gz
Initial launch	~60 KB gz	unchanged
Per-platform kconfig graph	—	~14 KB / ~1.8 KB gz
Per-platform kconfig help	—	~9 KB / ~3.8 KB gz

Bundle still under the 250 KB perf budget.

Test plan

• `npm test` — 46 active pass, 7 skipped (3 live + 4 bundle pending dist)
• `npm run build` — clean, bundle invariants pass
• Manual end-to-end with injected kconfig data: `index.json` exposes `kconfig_available_for`, per-platform `kconfig-graph..json` URL loads with correct schema, BUSYBOX shows `selected_by: [BR2_INIT_BUSYBOX]`
• Dispatch the workflow on this branch (test+build green, deploy correctly rejected by main-only branch policy) before merge
• Wait for firmware kconfig-graph PR to merge + one nightly cycle, then merge this
• After merge: cron-triggered build + deploy populates Pages; Configure tab lights up for platforms with kconfig data; defconfig fragment downloads work

🤖 Generated with Claude Code