deep profile + threshold gating + firmware stage + Burn super-stage

Ships all five phases of the deep-profile overhaul together. Runs now
carry a profile (quick/deep/soak); every profile walks the same
11-stage order — Inventory → Firmware → SpecValidate → SMART →
CPUStress → Storage → Network → Burn → GPU → PSU → Reporting —
with only per-stage durations and concurrency scaled.

Phase 1: profiles.ProfileRegistry loaded from vetting.yaml; runs.profile
column + CreateWithProfile; threshold table + evaluator seeded per-run
from the shared vetting.thresholds block; breach flips result at
/sensor + /result.

Phase 2: upgraded CPUStress (stress-ng --cpu-method=all --verify +
EDAC/MCE poll), Storage (fio --verify=md5 + SMART start/end delta),
Network (sustained iperf + /proc/net/dev deltas) with per-profile
knobs from Deps.

Phase 3: Burn super-stage with goroutine fan-out for CPU + memory +
fio + iperf, PSU rails sampled across the Burn window, SensorMux
(2 s flush, 500-sample cap) to absorb backpressure.

Phase 4: Firmware stage + firmware_snapshots table; probes dmidecode
(BIOS), ipmitool (BMC), ethtool -i (NIC), nvme (sysfs + id-ctrl),
lspci (HBA), /proc/cpuinfo (microcode). spec.DiffFirmware folds into
SpecValidate with pin-by-identifier and fan-out-across-component
matching; mismatches park the run in FailedHolding.

Phase 5: profile radio on the host start form, profile chip on the
run header, Firmware section in the HTML report, coverage artifact
uploaded from CI, agent/tests/fakes/ scaffold with Deps.LookPath
seam + stress_ng and dmidecode example fakes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/config/config.go

@@ -20,6 +20,13 @@ type Config struct {
 	Agent      Agent      `yaml:"agent"`
 	Notifiers  []Notifier `yaml:"notifiers"`
 	Routes     []Route    `yaml:"routes"`
+
+	// Profiles holds the Phase-1 quick/deep/soak registry (stage order,
+	// threshold defaults, per-profile stage timeouts + probe knobs).
+	// Populated from the `vetting:` and `profiles:` top-level blocks
+	// during Load. Nil is never returned — Load installs a default
+	// registry when those blocks are absent.
+	Profiles *ProfileRegistry `yaml:"-"`
 }
 
 type Server struct {
@@ -111,6 +118,20 @@ func Load(path string) (*Config, error) {
 	if err := yaml.Unmarshal(b, &c); err != nil {
 		return nil, fmt.Errorf("parse config: %w", err)
 	}
+	// The `vetting:` + `profiles:` blocks live alongside the existing
+	// fields but we decode them into the raw shape because YAML
+	// durations arrive as strings. Reusing the same byte buffer is
+	// safe: yaml.Unmarshal is happy to ignore keys the target doesn't
+	// know about.
+	var rawProfiles rawProfilesBlock
+	if err := yaml.Unmarshal(b, &rawProfiles); err != nil {
+		return nil, fmt.Errorf("parse profiles: %w", err)
+	}
+	reg, err := buildProfileRegistry(rawProfiles)
+	if err != nil {
+		return nil, fmt.Errorf("profiles: %w", err)
+	}
+	c.Profiles = reg
 	if c.Server.Bind == "" {
 		c.Server.Bind = "127.0.0.1:8080"
 	}