debug: risc-v-gsp-rm-debugger final pass - remove in-development notices, complete rename, adversarial-review fixes

Remove the '# TOOL IN DEVELOPMENT - NOT READY YET!' notices from the tool docs/README/scripts and the project docs; record the removal (2026-10-02) against the tool audit (debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md), the 194-test suite and the value-validation demos (docs/25-VALUE-VALIDATION.md).

Complete the cosmetic rename to risc-v-gsp-rm-debugger in user-facing prose and commands (launcher, roadmap, docs); internal greeneye package and code identifiers unchanged.

Adversarial-review fixes: deterministic control-discovery sweep (flaky test root-caused), UUID session dirs + atomic JSON writes for concurrent runs, Ghidra bridge loopback enforcement and clean shutdown, fp register restore in Session.call, version_diff --dry-run, 30 s interrupt budget, dry-run non-destructiveness verified.

Docs: flag-removal records, link fixes, command/flag corrections (fdematch arity, port_new_device --out, trace filename), F2 orchestration note in future-eng-ops; STATE-CURRENT status refreshed.

1 files changed, 6 insertions, 7 deletions

diff --git a/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md b/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
index a842368..4e96a44 100644
--- a/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
+++ b/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
@@ -1,6 +1,5 @@
 # 16 — Custom simulator: design and implementation plan
-> **# TOOL IN DEVELOPMENT - NOT READY YET!** See 00 for status; this is a
-> far-later design, do not implement ahead of the H3 gate.
+> This is a far-later design, do not implement ahead of the H3 gate.
 
 ## 1. Purpose and status
 
@@ -18,7 +17,7 @@ hoc. This document scopes it.
 ### 1.1 M1 status (implemented in this tree)
 
 M1 was explicitly commissioned and is implemented behind `--backend native`;
-the status marker above still applies to the remaining milestones (M2–M6) and
+the gating above still applies to the remaining milestones (M2–M6) and
 to any use on real GSP images.
 
 * **What exists.** A pure-Python, stdlib-only RV64IMAC interpreter under
@@ -76,9 +75,9 @@ plugin and without leaving the process:
   `trace` config/counts in the metadata), so it never swamps `events.jsonl`;
   folded `exec`/`access`/`read`/`write` events in `events.jsonl` are also
   accepted by the analyzer.
-* **Analyzer.** `greeneye analyze` renders an `## Execution trace` section:
+* **Analyzer.** `./risc-v-gsp-rm-debugger.sh analyze` renders an `## Execution trace` section:
   exec/read/write totals, unique PCs grouped by symbol, and accessed 4 KiB
-  pages with read/write counts. `greeneye compare` adds a trace-stream totals
+  pages with read/write counts. `./risc-v-gsp-rm-debugger.sh compare` adds a trace-stream totals
   delta and includes trace writes in the written-page delta.
 * **API.** `ge.launch(..., backend="native", trace=...)` and
   `launch_native(trace=...)` take `True`, a dict
@@ -414,7 +413,7 @@ single producer for stop-based and full-access events:
 the same run yields the same file. `exec`/`access` volume is controlled by
 profile logging and a ring budget; for the native backend that is implemented
 (M1.5, §1.1a): the stream is a session blob and the analyzer renders coverage
-and accessed pages. `greeneye compare` treats backend identity, `t` and
+and accessed pages. `./risc-v-gsp-rm-debugger.sh compare` treats backend identity, `t` and
 host paths as non-semantic, so cross-backend comparison is first-class.
 
 ## 11. Injection ABI
@@ -471,7 +470,7 @@ familiar with the codebase; milestones are sequential.
 | M3 | Deterministic scheduler (budgets, timers, IRQ events) + event log/replay | multi-task test profile replays identically from the log on two hosts; tie-break and replay tests in CI | 3–4 wk |
 | M4 | Device-model parity with H2.2 + `dma`/`pmu_stub` + boot shims | real GSP image reaches the same stable state as the QEMU H2 exit under the same profile; differential suite passes for probe and boot fixtures; L3 parity documented, L2 still not claimed | 6–10 wk |
 | M5 | Injection ABI + service registry + `log`/`stub`/`forward` interception | an SDK v1 blob loads and serves a control end-to-end; each interception mode has a recorded acceptance session; fuzzing seed/restore demonstrated | 4–6 wk |
-| M6 | Performance/ergonomics: profiling, fast paths, `--backend native`, docs + flag-removal criteria | §14 targets met; `greeneye demo --backend native` in the differential CI job; user docs updated | 3–4 wk |
+| M6 | Performance/ergonomics: profiling, fast paths, `--backend native`, docs + status/marker criteria | §14 targets met; `./risc-v-gsp-rm-debugger.sh demo --backend native` in the differential CI job; user docs updated | 3–4 wk |
 
 > **M1 status: done (pure-Python reference implementation).** Ported without
 > the `Backend` refactor (see §5 note); differential parity and a determinism