Self-update writes the new build to SD, then boots known-good /boot.dol

Previous version launched the image it had just received, which is the one
thing that cannot be made safe: a broken build hangs the console and the
checks can only catch a truncated or non-DOL image, never a plausible but
broken one.

The flow is now receive -> write to SD -> boot /boot.dol:
  - netboot_sd_write() mounts the card (auto-detecting SD2SP2, then SD Gecko
    slot B, then slot A), writes the image to the path the host asked for,
    and READS IT BACK AND COMPARES.  A half-written .dol that still parses is
    exactly the failure this design exists to avoid, and the card is the one
    component here with no other integrity check.
  - netboot_boot_file() then loads /boot.dol -- a known-good Swiss -- and
    launches that instead.

So the only image this ever jumps into is one that was already known good.  A
broken test build costs nothing: Swiss comes up and can load anything,
including the previous build.  If the SD write or verify fails, nothing is
launched at all and the menu is still there.

The destination path travels in the DONE frame rather than being baked in, so
the host decides where the build lands (send-dol.py --dest, default
/gc_bba_test.dol).

libfat is unmounted before the jump: leaving the card mounted hands the next
image a filesystem libfat still thinks it owns, on an EXI channel it is about
to reinitialise.

Note the SD Gecko in memory-card slot A shares EXI channel 0 with the BBA
(channel 0, device 2).  libogc arbitrates, but SD2SP2 is on its own channel
and avoids the question -- hence the detection order.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

gc_bba_test/source/main.c

@@ -131,10 +131,10 @@ static void do_netboot(char *status, size_t nstatus)
 
 	printf("\n" C_HEAD "  Self-update over the BBA" C_RESET "\n\n");
 	printf("  On the host:  sudo ./scripts/send-dol.py <iface> <file.dol>\n\n");
-	printf(C_DIM "  Send a KNOWN-GOOD image the first time -- Swiss's boot.dol\n"
-	       "  is ideal: it is unmistakable when it boots, so it tells you the\n"
-	       "  transfer AND the launcher both work before you trust either\n"
-	       "  with an untested build.\n" C_RESET "\n");
+	printf(C_DIM "  The received build is WRITTEN TO THE SD CARD and verified;\n"
+	       "  it is never launched directly.  This then boots /boot.dol --\n"
+	       "  your known-good Swiss -- so a broken test build costs nothing:\n"
+	       "  Swiss comes up and can load whatever you like.\n" C_RESET "\n");
 	printf("  Blocks until done or it times out (30 s idle, 5 s mid-xfer).\n\n");
 
 	if (!s_stage) {
@@ -148,19 +148,26 @@ static void do_netboot(char *status, size_t nstatus)
 		return;
 	}
 
-	printf("\n  launching %d bytes...\n", len);
-	/* Give the console a frame to actually show that before we disable
-	 * interrupts and overwrite ourselves. */
+	rc = netboot_sd_write(netboot_dest_path(), s_stage, (u32)len, nb_status);
+	if (rc < 0) {
+		/* Nothing has been launched and nothing is half-written that we
+		 * know of, so staying in the menu is the safe outcome. */
+		snprintf(status, nstatus, "SD write failed (%d) - nothing launched", rc);
+		return;
+	}
+
+	printf("\n  booting /boot.dol ...\n");
 	VIDEO_WaitVSync();
 	VIDEO_WaitVSync();
 
-	rc = netboot_launch(s_stage);
-	/* Only reached on refusal.  -2 = header implausible (truncated or not a
-	 * DOL); -3 = a section would land on the reserved staging region, which
-	 * would corrupt the image or the copier mid-flight. */
+	/* Reuse the staging region: the new build is already on the card and
+	 * verified, so the copy in RAM is finished with. */
+	rc = netboot_boot_file("/boot.dol", s_stage, s_stage_max, nb_status);
+
+	/* Only reached on refusal.  The new build IS on the card either way,
+	 * so this is recoverable by rebooting into Swiss by hand. */
 	snprintf(status, nstatus,
-	         rc == -3 ? "refused: image overlaps staging region"
-	                  : "refused: not a plausible DOL");
+	         "update saved, but /boot.dol would not boot (%d)", rc);
 }
 
 int main(void)