SETOOLS: no --setools-dir flag, SETOOLS_DIR is undocumented, and the manifest field is destroyed by the next build

[alpCaner]

Found while reviewing

feat/v06-batch at 13891f1.

The agreed shape for SETOOLS is: it is license-gated, obtained from Alif, and never redistributed by tan or alp-sdk — the customer installs it themselves and points tan at it, and tan warns clearly when it is missing. python/tan/core/setools.py:98-108 accepts two sources:

1. flash_args.setools_dir, read from build/system-manifest.yaml;
2. the SETOOLS_DIR environment variable.

Both are broken as the customer's durable answer:

• There is no --setools-dir flag. tan flash --help offers nothing.
• build/system-manifest.yaml is regenerated by tan build (python/tan/commands/build/manifest.py:211), and the alp-sdk emit carries no setools_dir key — so a customer's hand-edit is destroyed by their next build, silently.
• SETOOLS_DIR is documented nowhere. git grep SETOOLS_DIR -- docs README.md returns nothing. The only place a customer ever learns the variable exists is unresolved_message(), which they reach by failing first.

Impact

The one supported way to configure a license-gated tool is an undocumented environment variable, discoverable only by triggering an error. The alternative the code offers is a file that gets overwritten. For a first flash to real silicon this is the step most likely to strand someone.

Acceptance criteria

• A --setools-dir <PATH> flag on tan flash, taking precedence over SETOOLS_DIR, which in turn takes precedence over flash_args.setools_dir. The precedence order is stated in --help.
• README.md documents all three, says SETOOLS is obtained from Alif and is not redistributed, and does not link anything login-gated.
• unresolved_message() names every accepted source, in precedence order, with the flag first.
• Either tan build preserves an existing flash_args.setools_dir across a regeneration, or the docs say plainly that the manifest field is build-owned and not the place to put it.
• A test covers precedence with all three set.

Related: #353.

[alpCaner]

Fixed on dev in ac79d4c (PR #352), and verified by running that freeze in a pristine ubuntu:24.04 carrying only ca-certificates, git, python3 -- not by code presence.

dev IS this repo default branch, so Closes does fire here; this issue was filed after the PR body closing-keyword list was written, so it was never in it. Closed by hand -- a merged PR body cannot close retroactively.

Verified in the container: tan flash --help carries --setools-dir and mentions SETOOLS. Precedence is flag > SETOOLS_DIR > flash_args.setools_dir, with the manifest demoted deliberately since tan build regenerates system-manifest.yaml. docs/setools.md documents all three and states SETOOLS is license-gated, obtained from Alif and never redistributed here; the resolved source is now reported on a SUCCESSFUL sign, not only in a failure message.