Check BIOS assets selected by the setup recipe

[Alexbeav]

A retail-only SDK currently fails staging when unused OpenBIOS files are absent. Read the staged game.toml and require its selected BIOS profile. OpenBIOS-enabled recipes still require the OpenBIOS profile, image and license. Reject a missing recipe, missing selected profile or profile outside the staged kit.

Ten source-owned synthetic tests cover the policy. The unchanged shell gate rejects a retail-only fixture for missing OpenBIOS; the checker passes the corrected fixture and rejects the negative controls. Run python runtime/tests/test_setup_bios_assets.py.

Fork review exposed a containment gap in default/OpenBIOS paths. Resolve every required path in the common gate before checking that it stays inside the kit. Six external file/directory symlink assertions fail before this correction; all ten tests pass afterward, with no symlink skips on the native Windows test host. Internal symlinks remain supported. The complete SDK stage, owned generation and runtime suite were repeated after this correction. The runtime source and generated bytes remain identical, so the exact previously built game executable is reused for the fresh isolated startup/normal-close check.

The complete stage_setup_sdk.sh also passed with an actual retail-only SCPH1001 SDK and no OpenBIOS assets. The resulting SDK verified an owned disc, generated game and BIOS code, and built the native runtime. Emitters used documented PSXRECOMP_STATIC_CLI=ON to avoid unrelated ambient MinGW DLL selection.

This changes asset validation only. Current upstream's retail CLI generation still selects SCPH1001. Accepting an explicit SCPH5552 profile at the asset gate does not establish full SCPH5552 CLI support; that integration, including existing #243, remains separate. No retail BIOS is added to source or redistributed.

Validation and limits

• Exact base: 8d56cf659fd84367c3f778e17851674ac7896371; review head: 406451cb92da4d9f701c81b8271e420cef8677cc.
• Native Windows GCC 16 runtime builds and passes 69/69 enabled runtime tests; two additional tests are disabled in the source configuration. The build has UI, setup wizard, debug tools, netplay, rewind and Vulkan disabled.
• Owned Ghost in the Shell (SCES-01050) with owned SCPH1001: verification, current-source generation, native build and an isolated 50-second startup pass; normal SDL window close at frame 2447, process exit 0. Executable SHA-256 474ec448d1fa040f21f121a99695ede07cfc362d893305813419269b535b70d5. This is bounded startup and normal shutdown, not gameplay completion or listening acceptance. Audio used SDL dummy output. No native Linux/macOS game route is claimed.
• The unchanged current recompiler builds and has 58/61 enabled tests passing, with three pre-existing baseline failures (dirty_text_continuation_guards, aot_overlay_discovery, release_zip) and three disabled tests. This branch does not change that recompiler source. Those baseline failures are not reported as passes.
• Diff audit: general source repair, synthetic tests and documentation only; no retail disc/BIOS, generated game code, player data or private tooling.

Scope and fork review

Fork review #24 inspected this exact head against immutable review-base/mstan-8d56cf659fd8. Cubic found no remaining issues on the exact head (review IDs: 5133120825). The initial file/directory symlink findings were valid and fixed in the common asset check; both threads are resolved after failing-before/passing-after tests and repeated staging/runtime/owned-route validation. The public PR branch points to the same commit. Upstream master was fetched again and remains the recorded base. This contribution contains 2 commit(s) and 5 changed files.

• docs/SETUP_BIOS_ASSETS.md: behavior and verification documentation.
• runtime/CMakeLists.txt: source-owned regression and test registration.
• runtime/tests/test_setup_bios_assets.py: source-owned regression and test registration.
• tools/check_setup_bios_assets.py: bounded correction.
• tools/stage_setup_sdk.sh: bounded correction.

Developed with AI assistance; validated as described (test evidence in PR body). AI writes the code and the PR, but I always test before I send something up. Happy to iterate on this process with your feedback.