Make `pi-hardware-test.yml` truthful: stop probing the runner's Linux, pin the same Zig as ci.yml, fail red until a HomeOS image really boots

Epic: #113 · Milestone: MC1 — Toolchain: aarch64

Why

The 453-line workflow builds nothing real (unified arm64 prints a message; rpi5 … || true), then cp build/arm64/kernel8.img a file that is never produced. Its ten test jobs run static-checks/hardware/pi_*_test.sh (2,392 lines) which check /dev/fb0, /sys/class/graphics/fb0/bits_per_pixel, /dev/dri/card* — i.e. Raspberry Pi OS on the runner, and every failure path is log_warn … return 0. It also pins a different Zig (0.17.0-dev.56) than ci.yml (0.17.0-dev.1441). This is exactly the kind of lying build MASTER_PLAN Phase 0 removed elsewhere (S1).

Tasks

• Replace the workflow body with: build job = ./scripts/build.sh rpi5 --profile=serial (real, from #54), artifact = the boot dir; test job = disabled (if: false) with a comment pointing at #111 until a self-hosted rig exists.
• Move static-checks/hardware/pi_*_test.sh to static-checks/hardware/legacy/ with a banner stating they test the host OS, or delete them.
• Single source of truth for the Zig version: scripts/zig-version.txt read by both workflows and by build.sh's toolchain check.
• Remove kernel8.img naming (Pi 3/4 era); Pi 5 image is kernel_2712.img.

Acceptance

Workflow either builds a real image and uploads it, or fails red with the blocker named. No || true, no return 0 on failure paths.

Size: S · Depends on: #54 · Blocks: #111