refactor: modularize audit and harden build validation

bible-local/decisions/2026-04-01-memtest-build-strategy.md

@@ -175,8 +175,8 @@ those files may not exist yet. Instead:
 
 - Tries to copy `memtest86+x64.bin` / `memtest86+x64.efi` from `chroot/boot/` first.
 - Falls back to extracting from the cached `.deb` (via `dpkg-deb -x`) if `chroot/boot/` is empty.
-- Appends GRUB and isolinux menu entries only if the respective cfg files already exist at hook time.
-  If they do not exist, the hook warns and continues (does not fail).
+- It does not edit bootloader menus. The complete menus are rendered later
+  from the two canonical project templates.
 
 Controlled by `BEE_REQUIRE_MEMTEST=1` env var to turn warnings into hard errors when needed.
 
@@ -186,7 +186,8 @@ After `lb build` completes, `build.sh` checks whether the fully materialized `bi
 contains all required memtest artifacts. If not:
 
 - Copies/extracts memtest binaries into `binary/boot/`.
-- Patches `binary/boot/grub/grub.cfg` and `binary/isolinux/live.cfg` directly.
+- Calls `enforce_live_build_bootloader_assets`, which renders the complete
+  GRUB and isolinux configs from the canonical project templates.
 - Reruns the late binary stages (`binary_checksums`, `binary_iso`, `binary_zsync`) to rebuild
   the ISO with the patched tree.