fix: payload ptrace/mount/symlink hardening + SDK version docs + install-all trim

[phantomptr]

Description

Fixes found during a full-repo scan (payload C, Rust engine, TS client, docs/scripts). All are defensive/failure-path changes plus a docs correction and a WIP trim — no success-path behavior changes.

Changes

Payload — ShellUI RPC ptrace hardening (payload/src/ptrace_remote.c). Candidate root cause for the FW-12 install crash where the on-console helper goes unreachable after a rejected install (see #152, #164, #81):

• pt_mmap: a failed remote mmap returns -errno in rax, but callers only checked ==-1 || ==0 — so -ENOMEM (0xFFFF…F4) was used as a valid pointer and dereferenced inside SceShellUI → crash. Now collapses the whole [-4095,-1] range to -1 in one place.
• pt_syscall: restores bak_reg on the pt_step/pt_getregs failure paths (mirroring pt_call), so a later PT_DETACH can't resume ShellUI at the syscall site with junk argument registers.
• pt_attach: PT_DETACH on waitpid failure so a mid-attach EINTR can't leave ShellUI frozen with our tracer leaked.

Payload — FS_MOUNT + reconcile (payload/src/runtime.c):

• Validate the derived mount_name too, and reject a lone . — otherwise mount_name="." (or an image named ..exfat) builds /mnt/ps5upload/. which the kernel normalises to the namespace root, shadowing every existing mount.
• Bump reconcile's src[256] → src[512] to match the writer / find-existing buffers (long source paths were truncated → false "source missing" at boot).

Payload — sce_sys staging symlink safety (payload/src/register.c): copy_dir_recursive uses lstat() instead of stat(), so a symlink is skipped (as the existing comment already claims) rather than followed — a hostile dump's sce_sys/leak -> /system_data/... no longer copies a system file into user space, and a dangling link no longer aborts the whole copy.

Client — install-all WIP trim (client/src/state/pkgLibrary.ts): removes an unfinished installAll/installingAll that was declared on the store interface without an implementation (TypeScript TS2739 → CI red) plus an orphaned pkgEntryInstallOrder helper. Keeps the standalone-good failure-notification bell so a failed install rings the bell instead of only updating the row (partially addresses #137).

Docs — SDK version (README.md, FAQ.md, scripts/install-{macos,ubuntu,windows}): bump pinned PS5 Payload SDK v0.38 → v0.40 to match CI/release (publish.yml, engine-ci.yml). v0.38 predates getloadavg(), so make install && make payload against it failed to link. The historical CHANGELOG 2.12.1 entry is left untouched.

Type of Change

• Bug fix (non-breaking)
• Documentation update

Testing

• Payload builds clean with -Wall -Wextra -Werror against SDK v0.40.
• Client: typecheck, lint, 754 Vitest tests, i18n coverage (18 langs) all pass.
• The three ptrace fixes are failure-path-only, so they don't change success-path behavior on tested firmware (FW 5.10 / 9.60). The FW-12 crash candidate needs FW-12 hardware to confirm end-to-end.

🤖 Generated with Claude Code