deep profile + threshold gating + firmware stage + Burn super-stage

Ships all five phases of the deep-profile overhaul together. Runs now
carry a profile (quick/deep/soak); every profile walks the same
11-stage order — Inventory → Firmware → SpecValidate → SMART →
CPUStress → Storage → Network → Burn → GPU → PSU → Reporting —
with only per-stage durations and concurrency scaled.

Phase 1: profiles.ProfileRegistry loaded from vetting.yaml; runs.profile
column + CreateWithProfile; threshold table + evaluator seeded per-run
from the shared vetting.thresholds block; breach flips result at
/sensor + /result.

Phase 2: upgraded CPUStress (stress-ng --cpu-method=all --verify +
EDAC/MCE poll), Storage (fio --verify=md5 + SMART start/end delta),
Network (sustained iperf + /proc/net/dev deltas) with per-profile
knobs from Deps.

Phase 3: Burn super-stage with goroutine fan-out for CPU + memory +
fio + iperf, PSU rails sampled across the Burn window, SensorMux
(2 s flush, 500-sample cap) to absorb backpressure.

Phase 4: Firmware stage + firmware_snapshots table; probes dmidecode
(BIOS), ipmitool (BMC), ethtool -i (NIC), nvme (sysfs + id-ctrl),
lspci (HBA), /proc/cpuinfo (microcode). spec.DiffFirmware folds into
SpecValidate with pin-by-identifier and fan-out-across-component
matching; mismatches park the run in FailedHolding.

Phase 5: profile radio on the host start form, profile chip on the
run header, Firmware section in the HTML report, coverage artifact
uploaded from CI, agent/tests/fakes/ scaffold with Deps.LookPath
seam + stress_ng and dmidecode example fakes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

cmd/vetting/main.go

@@ -60,6 +60,8 @@ func main() {
 	artifactStore := &store.Artifacts{DB: conn}
 	specDiffStore := &store.SpecDiffs{DB: conn}
 	measurementStore := &store.Measurements{DB: conn}
+	thresholdStore := &store.Thresholds{DB: conn}
+	firmwareStore := &store.Firmware{DB: conn}
 
 	hub := events.NewHub()
 
@@ -99,17 +101,19 @@ func main() {
 	}
 
 	ui := &api.UI{
-		Hosts:     hostStore,
-		Runs:      runStore,
-		Stages:    stageStore,
-		SubSteps:  subStepStore,
-		SpecDiffs: specDiffStore,
-		Artifacts: artifactStore,
-		EventHub:  hub,
-		Logs:      logHub,
-		Runner:    runner,
-		Tiles:     tiles,
-		PublicURL: cfg.Server.PublicURL,
+		Hosts:      hostStore,
+		Runs:       runStore,
+		Stages:     stageStore,
+		SubSteps:   subStepStore,
+		SpecDiffs:  specDiffStore,
+		Artifacts:  artifactStore,
+		Thresholds: thresholdStore,
+		Profiles:   cfg.Profiles,
+		EventHub:   hub,
+		Logs:       logHub,
+		Runner:     runner,
+		Tiles:      tiles,
+		PublicURL:  cfg.Server.PublicURL,
 	}
 
 	// Inject the host-page + run-page fragment renderers. Each reuses
@@ -157,6 +161,9 @@ func main() {
 		Artifacts:       artifactStore,
 		SpecDiffs:       specDiffStore,
 		Measurements:    measurementStore,
+		Thresholds:      thresholdStore,
+		Firmware:        firmwareStore,
+		Profiles:        cfg.Profiles,
 		Runner:          runner,
 		EventHub:        hub,
 		Logs:            logHub,