[Zhanfg]

Context

Companion to KernelPatch-Public PR #16.

Add fail-closed runtime discovery to the existing PatchNest manager without altering existing patch/unpatch or embedded KPM flows.

Changes

• module/runtime_probe.sh (installed from module/module/) reports:
  • native only when a versioned patchnest-status ioctl client returns a real ABI v1 handshake.
  • native-unverified or native-incompatible when the device exists but cannot be negotiated.
  • patched-legacy when the old kpatch hello handshake succeeds (does not claim new ABI capability).
  • none otherwise.
• module/webui/runtime-status.js strict capability parser, no loading/flashing operations.
• Read-only runtime label on the existing UI overview without elevating KPM support.
• Vitest parser regression tests.

Not yet in scope

• Shipping the ARM64 patchnest-status binary into the installer; this requires validated KernelPatch-Public toolchain assets and pinned checksums.
• Native KPM loader, patched ABI adapter, run-time mutation, and device acceptance.
• Changing patch/flash buttons or releasing a module package.

Remain Draft until common ABI and device evidence are available. Keep main untouched.