Harden passkey fix and document security audit

[MECMwithShawn]

What changed

• verifies the pinned BlueZ 5.77 archive checksum and uses private temporary paths
• preserves unrelated BlueZ configuration and prevents automatic downgrades from newer releases
• replaces destructive BLE cleanup with bounded high-water cleanup that preserves active and trusted devices
• limits discoverability to 180 seconds and removes unmanaged privileged monitor processes
• corrects the BlueZ advertisement monitor application hierarchy and clean unregistration
• completes rollback coverage, secures trace output, and guards destructive experimental helpers
• removes the unsupported raw-HCI MSFT script and incomplete kernel patch
• adds audit documentation, line-ending policy, and regression tests

Why

The original installer and helper scripts contained several security and reliability hazards: unverified root downloads in predictable paths, wholesale configuration replacement, permanent discoverability, broad device deletion, incomplete rollback, and an advertisement monitor that did not implement BlueZ's documented registration contract. The removed MSFT path could also report success without proving that firmware scanning had changed.

Impact

The project is safer to inspect and test as an experimental workaround. It no longer presents the adapter-specific diagnosis as universally proven. A live Ubuntu/AX211 validation is still required before marking this ready for release.

Validation

• 7/7 project audit tests pass
• all shell scripts pass bash -n
• Python monitor syntax and compilation pass
• BlueZ patch applies cleanly in dry-run mode to the verified upstream 5.77 archive
• staged diff passes git diff --check
• obvious credential-pattern scan is clean

Remaining risk

The installer still uses upstream make install into /usr; packaging the patched build as a .deb remains the recommended follow-up.