keypad: source-ground AGM M7 matrix pins and GPIO transactions before device scan

[forkwright]

Finding

The non-QEMU boot-passphrase keypad path directly configures and scans GPIO using placeholder row/column pins and a generic MT67xx register layout. The source itself says the AGM M7 assignments are unverified, but boot can execute those MMIO writes before any hardware qualification. #753 owns later service-loop reachability, not the board pin/register contract.

Evidence

• crates/thumos/src/board/m7.rs sets row pins 40-43 and columns 44-46 as placeholders copied from the unlinked haphe surface.
• GPIO_BASE and direction/data/pull bank offsets are generic-family assumptions pending MT6739 grounding.
• crates/thumos/src/keypad.rs writes those direction/output/pull registers and polls inputs in the non-QEMU boot path.
• Host tests inject matrix state and therefore cannot validate pins, mux mode, bank stride, pull semantics, polarity, electrical settle timing, or conflicts.

Why this matters

Wrong GPIO/pinmux writes can alter unrelated board functions or make the boot credential gate unusable. This is source-adjudication/software work before an M7 session, not a fact that a physical smoke test should discover by executing placeholder writes.

Done when

• Pin authoritative AGM M7/MT6739 evidence for matrix dimensions, row/column pins, mux modes, GPIO controller/bank layout, direction/data/pull semantics, polarity, and settle/debounce timing.
• Device builds fail closed with boot matrix scanning disabled until the board profile is accepted; no placeholder GPIO write reaches hardware.
• Separate pure debounce/key-map policy from the source-grounded hardware adapter.
• Tests cover bank boundaries, pin conflicts, stuck/open/shorted lines, ghosting/multi-key behavior, timeout/unavailable input, and fail-closed boot-secret entry.
• kernel: tracking anchor for the compiled-but-unwired surface #753 consumes the accepted adapter for service-loop input without duplicating pin ownership.
• Only after software/source acceptance may an operator-owned M7 keypad receipt run.