flash: a .hex resolves to a sibling .bin instead of being refused, and the comment plus the test name both say the opposite

[alpCaner]

Found while reviewing

feat/v06-batch at 13891f1.

python/tan/core/flash_plan.py:1325-1328, beside the one write that can brick slot0:

A .hex, or an ELF with no sibling .bin, still hits the refusal below untouched.

is_raw_bin("zephyr.hex") is false, so :1331-1333 swaps in zephyr.bin and :1334 passes. The .hex does not hit the refusal. a4ef232's commit message repeats the same false claim.

#353's own acceptance text is explicit: "#311's guard stays exactly as strict for anything that is genuinely not a raw image — it should refuse a .hex".

And python/tests/commands/test_flash_command.py:2247:

def test_a_hex_artefact_is_refused_even_with_a_sibling_bin(...):
    """... the guard's job is to refuse anything that is not a raw image, and a
    `.hex` ... is exactly that. Resolving it would silently flash a DIFFERENT
    artefact than the manifest named ..."""
    ...
    assert "zephyr.bin 0x80010000" in script

The body asserts the .hex is not refused. A green test under that name is affirmative evidence for a fact that is false — the worst shape a test can take, because it makes the next reader stop looking.

Why it matters beyond tidiness

The resolution is stem-based and extension-agnostic: any foo.<anything> next to a foo.bin silently becomes foo.bin. A manifest naming zephyr.hex gets zephyr.bin written to MRAM without a word. That may well be the behaviour we want — but three places currently document the opposite of what one line of code does, and the disagreement sits next to loadbin.

Acceptance criteria

Pick one and make all four agree — code, comment, commit-message claim, test name:

• (a) Refuse a .hex as flash: an AEN801 slot0 flash needs four values nothing in the chain emits -- no ATOC signing step, an ELF artefact, no probe selection #353's acceptance text says: restrict the sibling resolution to artefacts that are plausibly ELF (no extension, .elf, .out), leave everything else to the refusal.
• (b) Keep the extension-agnostic resolution and say so: rewrite the comment, correct flash: an AEN801 slot0 flash needs four values nothing in the chain emits -- no ATOC signing step, an ELF artefact, no probe selection #353's acceptance line, and rename the test to what it proves.

(a) is the smaller behavioural surface and matches what was agreed on #353; state the reason for whichever is chosen.

• The refusal or the resolution names the artefact it received AND the one it will actually write.
• The test's name, docstring and body agree.

Related: #311, #353.

[alpCaner]

Fixed on dev in ac79d4c (PR #352), and verified by running that freeze in a pristine ubuntu:24.04 carrying only ca-certificates, git, python3 -- not by code presence.

dev IS this repo default branch, so Closes does fire here; this issue was filed after the PR body closing-keyword list was written, so it was never in it. Closed by hand -- a merged PR body cannot close retroactively.

One resolve_slot0_binary now, ELF-only per option (a) -- no-extension, .elf, .out -- and the SETOOLS path receives the resolved shape instead of re-deriving it, so signing and writing cannot disagree. A .hex is refused, naming both what it received and what it wanted.

The self-contradicting test (test_a_hex_artefact_is_refused_even_with_a_sibling_bin, whose body asserted the opposite of its name) is corrected.