forge: step 9 — harden production bot builds

patches/meshcore/0007-Add-bot-build-flags-and-key-hardening.patch

@@ -0,0 +1,59 @@
+diff --git a/platformio.ini b/platformio.ini
+index 864e5e1f..dfed7dbd 100644
+--- a/platformio.ini
++++ b/platformio.ini
+@@ -54,6 +54,14 @@ build_src_filter =
+ 
+ ; ----------------- ESP32 ---------------------
+ 
++[cmesh_bot_production]
++build_flags =
++  -D CMESH_BOT_ENABLED=1
++  -UENABLE_PRIVATE_KEY_IMPORT
++  -UENABLE_PRIVATE_KEY_EXPORT
++  -D ENABLE_PRIVATE_KEY_IMPORT=0
++  -D ENABLE_PRIVATE_KEY_EXPORT=0
++
+ [esp32_base]
+ extends = arduino_base
+ platform = platformio/espressif32@6.11.0
+diff --git a/variants/heltec_v3/platformio.ini b/variants/heltec_v3/platformio.ini
+index 803ee683..ca9cf00d 100644
+--- a/variants/heltec_v3/platformio.ini
++++ b/variants/heltec_v3/platformio.ini
+@@ -144,6 +144,7 @@ build_flags =
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
+   -D DISPLAY_CLASS=SSD1306Display
++  ${cmesh_bot_production.build_flags}
+ ; NOTE: DO NOT ENABLE -->  -D MESH_PACKET_LOGGING=1
+ ; NOTE: DO NOT ENABLE -->  -D MESH_DEBUG=1
+ build_src_filter = ${Heltec_lora32_v3.build_src_filter}
+@@ -163,6 +164,7 @@ build_flags =
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
+   -D DISPLAY_CLASS=SSD1306Display
++  ${cmesh_bot_production.build_flags}
+   -D BLE_PIN_CODE=123456   ; dynamic, random PIN
+   -D AUTO_SHUTDOWN_MILLIVOLTS=3400
+   -D BLE_DEBUG_LOGGING=1
+diff --git a/variants/rak4631/platformio.ini b/variants/rak4631/platformio.ini
+index ea7e49c3..d6610098 100644
+--- a/variants/rak4631/platformio.ini
++++ b/variants/rak4631/platformio.ini
+@@ -122,6 +122,7 @@ build_flags =
+   -D DISPLAY_CLASS=SSD1306Display
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
++  ${cmesh_bot_production.build_flags}
+ ; NOTE: DO NOT ENABLE -->  -D MESH_PACKET_LOGGING=1
+ ; NOTE: DO NOT ENABLE -->  -D MESH_DEBUG=1
+ build_src_filter = ${rak4631.build_src_filter}
+@@ -143,6 +144,7 @@ build_flags =
+   -D DISPLAY_CLASS=SSD1306Display
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
++  ${cmesh_bot_production.build_flags}
+   -D BLE_PIN_CODE=123456
+   -D BLE_DEBUG_LOGGING=1
+   -D OFFLINE_QUEUE_SIZE=256

scripts/build-representative.sh

@@ -102,7 +102,7 @@ export FIRMWARE_VERSION="${FIRMWARE_VERSION:-local}"
 failed_envs=()
 for env in "${REPRESENTATIVE_ENVS[@]}"; do
   log_path="${LOG_DIR}/${env}.log"
-  echo "Building ${env}"
+  echo "Building ${env} (CMESH_BOT_ENABLED=1, private-key import/export disabled)"
   if (cd "$MESHCORE_DIR" && /usr/bin/env bash build.sh build-firmware "$env") >"$log_path" 2>&1; then
     if compgen -G "${MESHCORE_DIR}/out/${env}-*" >/dev/null; then
       cp "${MESHCORE_DIR}/out/${env}-"* "$ARTIFACT_DIR"/