[youtalk]

Stacks on #45.

Adds a compile-time ACTUATION_PARAM_PROFILE for the X5H CR52 firmware:

• after (the default) is the tuned profile and keeps the five longitudinal-controller deceleration defaults this tree already carried, so an unconfigured build is unchanged in behaviour on every target and the S32Z2, Zephyr and POSIX targets are unaffected.
• before selects the CES 2026 untuned deceleration limits (stopped_acc -0.4, emergency_acc -0.75, emergency_jerk -1.0, min_acc -0.75, min_jerk -1.0).

Selected with build.sh --platform freertos-x5h --param-profile before|after. The profile name is printed in the FreeRTOS boot banner, which also places actuation_param_profile=<name> in .rodata; check-elf-contract.sh gains an optional third argument that asserts it, so which profile an image carries is machine-verifiable before it is ever flashed. CI builds the before profile into its own -d directory and uploads it as a separate artifact, freertos-x5h-before-elfs, deliberately distinct from freertos-x5h-elfs so an operator fetching a flash image cannot confuse the untuned demo baseline with the image that ships.

Only the after image is a behavioural no-op: the boot banner now carries the identity string on both x5h images, so their .rodata differs from their predecessors by exactly that string.

Verified on hardware (2026-08-20). Both profiles were flashed onto an R-Car X5H Ironhide board and the MRM fault-injection scenario was run under each. Measured stop distance: before 52.96 m mean (3 runs), after 39.39 m mean (4 runs) — a 13.6 m / 34% difference, with the tuned profile reproducing to 0.33 m across six reflashes. Every run completed the MRM chain (mrm=succeeded, final commanded velocity zero). A disassembly diff of the two builds confirms exactly five changed constants in the longitudinal controller and nothing else.

The consuming side — the stop-distance measurement and the demo orchestrator — is a companion pull request in autowarefoundation/openadkit.

Why a compile-time switch, and not a parameter file

One question a reviewer will ask: why compile this in, when declare_parameter defaults can be overridden at run time with a parameter file? The run-time route works, but it leaves the firmware image ambiguous. The same ELF can then run as either profile, and which one it runs as depends on files that live outside the image. The compile-time switch stamps the profile name into .rodata, so check-elf-contract.sh reads the profile back out of the ELF alone. Before a board session we can prove which profile is about to be flashed, from the file we are about to flash and nothing else. That matters because the before profile is the untuned CES 2026 baseline. It brakes weakly on purpose. An operator must not be able to flash it while believing it is the tuned image that ships, and a parameter file cannot give that guarantee.