Assembly 1017a07c: recovered original NTS667I4; all THREE actual firewall blobs match exactly (root c30d6b54, windows 848a23fe, linux 08f615c4), no repair. Workspace all-target check passed after fixing one stale port argument in the #300 serving test. Starting exact CI clippy jobs=2; private asm-304-v3/target. No release build or push.