refactor: modularize audit and harden build validation

iso/builder/config/hooks/normal/9100-memtest.hook.binary

@@ -1,16 +1,14 @@
 #!/bin/sh
-# Ensure memtest is present in the final ISO even if live-build's built-in
-# memtest stage does not copy the binaries or expose menu entries.
+# Ensure memtest binaries are present even if live-build's built-in memtest
+# stage does not copy them. Boot menu entries come from the canonical templates
+# enforced by build.sh after live-build finishes.
 set -e
 
 : "${BEE_REQUIRE_MEMTEST:=0}"
 
-# memtest86+ 6.x uses memtest86+.bin (no x64 suffix) for the BIOS binary,
-# while 5.x used memtest86+x64.bin. We normalise both to x64 names in the ISO.
+# Debian Bookworm's pinned memtest86+ package installs these exact paths.
 MEMTEST_FILES="memtest86+x64.bin memtest86+x64.efi"
 BINARY_BOOT_DIR="binary/boot"
-GRUB_CFG="binary/boot/grub/grub.cfg"
-ISOLINUX_CFG="binary/isolinux/live.cfg"
 
 log() {
     echo "memtest hook: $*"
@@ -26,14 +24,6 @@ fail_or_warn() {
     return 0
 }
 
-# grub.cfg and live.cfg may not exist yet when binary hooks run — live-build
-# creates them after this hook (lb binary_grub-efi / lb binary_syslinux).
-# The template already has memtest entries hardcoded, so a missing config file
-# here is not an error; validate_iso_memtest() checks the final ISO instead.
-warn_only() {
-    log "WARNING: $1"
-}
-
 copy_memtest_file() {
     src="$1"
     dst_name="${2:-$(basename "$src")}"
@@ -52,16 +42,12 @@ extract_memtest_from_deb() {
     log "extracting memtest payload from ${deb}"
     dpkg-deb -x "$deb" "$tmpdir"
 
-    # EFI binary: both 5.x and 6.x use memtest86+x64.efi
     if [ -f "${tmpdir}/boot/memtest86+x64.efi" ]; then
         copy_memtest_file "${tmpdir}/boot/memtest86+x64.efi"
     fi
 
-    # BIOS binary: 5.x = memtest86+x64.bin, 6.x = memtest86+.bin
     if [ -f "${tmpdir}/boot/memtest86+x64.bin" ]; then
         copy_memtest_file "${tmpdir}/boot/memtest86+x64.bin"
-    elif [ -f "${tmpdir}/boot/memtest86+.bin" ]; then
-        copy_memtest_file "${tmpdir}/boot/memtest86+.bin" "memtest86+x64.bin"
     fi
 
     rm -rf "$tmpdir"
@@ -101,10 +87,6 @@ ensure_memtest_binaries() {
         for f in ${MEMTEST_FILES}; do
             [ -f "${BINARY_BOOT_DIR}/${f}" ] || copy_memtest_file "${root}/${f}" || true
         done
-        # 6.x BIOS binary may lack x64 in name — copy with normalised name
-        if [ ! -f "${BINARY_BOOT_DIR}/memtest86+x64.bin" ]; then
-            copy_memtest_file "${root}/memtest86+.bin" "memtest86+x64.bin" || true
-        fi
     done
 
     missing=0
@@ -141,54 +123,6 @@ ensure_memtest_binaries() {
     [ "$missing" -eq 0 ] || return 0
 }
 
-ensure_grub_entry() {
-    [ -f "$GRUB_CFG" ] || {
-        warn_only "missing ${GRUB_CFG} (will be created by lb binary_grub-efi from template)"
-        return 0
-    }
-
-    grep -q '### BEE MEMTEST ###' "$GRUB_CFG" && return 0
-
-    cat >> "$GRUB_CFG" <<'EOF'
-
-### BEE MEMTEST ###
-if [ "${grub_platform}" = "efi" ]; then
-    menuentry "Memory Test (memtest86+)" {
-        chainloader /boot/memtest86+x64.efi
-    }
-else
-    menuentry "Memory Test (memtest86+)" {
-        linux16 /boot/memtest86+x64.bin
-    }
-fi
-### /BEE MEMTEST ###
-EOF
-
-    log "appended memtest entry to ${GRUB_CFG}"
-}
-
-ensure_isolinux_entry() {
-    [ -f "$ISOLINUX_CFG" ] || {
-        warn_only "missing ${ISOLINUX_CFG} (will be created by lb binary_syslinux from template)"
-        return 0
-    }
-
-    grep -q '### BEE MEMTEST ###' "$ISOLINUX_CFG" && return 0
-
-    cat >> "$ISOLINUX_CFG" <<'EOF'
-
-# ### BEE MEMTEST ###
-label memtest
-    menu label ^Memory Test (memtest86+)
-    linux /boot/memtest86+x64.bin
-# ### /BEE MEMTEST ###
-EOF
-
-    log "appended memtest entry to ${ISOLINUX_CFG}"
-}
-
-log "ensuring memtest binaries and menu entries in binary image"
+log "ensuring memtest binaries in binary image"
 ensure_memtest_binaries
-ensure_grub_entry
-ensure_isolinux_entry
 log "memtest assets ready"