Y2B-210 — Select the CPU0-only diagnostic kernel configuration

> **Historical record.** The dates, candidate identity, "current" claims, > next steps and permissions below belong to this recorded boundary. See > [current state](../../CURRENT_PLATFORM_STATE.md) for the latest physically observed result.

Depends on Y2B-205 (#9). Use audited Linux v6.18 with only the documented D09 Kconfig visibility patch, allnoconfig plus a reviewed minimal fragment. D08 is fixed.

Acceptance:

ARMv7 little-endian ARM mode, CPU0 only, non-LPAE/non-highmem; appended DTB enabled and ATAG conversion disabled.
OF/GIC/MTK sysirq/GPT fundamentals; built-in initrd/gzip/ELF, proc/sysfs and diagnostic serial console support only.
No block/eMMC rootfs, network, USB, display, audio, radio, CMA, kexec or peripheral DMA framework.
Reconcile the resolved .config against mandatory options automatically. Document optional serial support as a launch-gated candidate, not proof of physical routing.

Validate configuration resolution in the locked environment. Kernel compilation and DTS/initramfs belong to subsequent checkpoints.

Configuration resolution initially rejected hidden ARM_VIRT_EXT=y. Bounded source review produced D09 (docs/build/kernel-policy.md): one prompt-visibility line, leaving the upstream default intact and allowing the existing no-hyp path. The resolved fragment now passes every mandatory option; memory policy is unchanged.