cycle: trust and deploy the iconfix plug-in set

The next installed run boots with the settings-icons executable
378ff525 installed and replaces it from single-user mode with SnapMetal
icon-pixels-next built the same way (lenient, ADRENO_PIPELINE,
ADRENO_SETTINGS_ICONS, runtime v7) plus ADRENO_CS_TABLES=1: AdrenoMetal
ba3a3fd6, CDHash 11d5ff9a. CoreImage's compute kernels then get
SP_CS_CONFIG NTEX = NSAMP = their T#/S# count and NUAV = their UAV
count; a process started with ADRENO_CS_TABLES=0 keeps the
settings-icons counts, so icon-pixels can compare both in one boot.

installed_fresh: the trust additions become the iconfix set's (the
settings-icons set's 47 rows plus 11d5ff9a and the icon-pixels probe
25f07e86: 501a90b6, payload 7857aabc); the settings-icons set stays as
ADDITIONS_SETTINGSICONS for rollback, and every earlier CDHash stays
trusted, so --restore (back to 378ff525) still boots. deploy-guest-
plugin: the executable's base is the settings-icons 378ff525 and its
payload the 27,627-byte AdrenoMetal-378ff525.bsdiff; the runtime and
CodeResources are already the installed ones and are skipped.

The probe's row: the guest's TXM service reports the code-signing
monitor disabled and answers only static trust-cache lookups
(compat/txm.h), so code outside the cache is left to in-kernel AMFI,
whose ad-hoc handling has never been observed in the guest; every
executable of ours that ran there (metal-triangle-probe,
metal-clear-probe) had its CDHash in the trust additions. The row costs
nothing and follows that pattern.

The set, build/current-assets/metal-stage-iconfix-20261024, is a local
(ignored) input: AdrenoMetal, AdrenoMetal-378ff525.bsdiff,
trust-additions.json, trustcache.payload and SET.json.

Evidence: the prepare-time trust check (configure_guest, then
trust_cache_spec(ADDITIONS).load(FIRMWARE) against TRUST_PAYLOAD and
TRUST_SHA) passes for the installed, -input and -input-touchpad
profiles, for this set and the settings-icons rollback; the payload
holds 11d5ff9a, 25f07e86, c76a4677 and runtime v7's ab4ccbd4;
tools/test-deploy-guest-plugin.py PASS 21 checks (install, again,
restore, refuse) over the console stand-in with 3% loss.

tools/cycle_lib/installed_fresh.py

@@ -332,10 +332,19 @@ QCC2072_INPUTS = 'qcc2072-inputs'        # under the attempt's directory: the th
 # Settings-icons set (SnapMetal ADRENO_SETTINGS_ICONS): the mirror-slab rows plus the executable c76a4677 (CoreImage
 # compute kernels sampling sRGB and grey+alpha images; multi-input kernels behind AdrenoIBComputeSamplers), deployed by
 # tools/deploy-guest-plugin.py; the mirror-slab set remains for rollback as ADDITIONS_MIRRORSLAB.
-ADDITIONS = 'build/current-assets/metal-stage-settingsicons-20261024/trust-additions.json'
-ADDITIONS_SHA = 'cdc784df778f7544fac5b2c774c3b6ee49cc70a15670301f3c4515dfed5562ff'
-TRUST_PAYLOAD = 'build/current-assets/metal-stage-settingsicons-20261024/trustcache.payload'
-TRUST_SHA = '247598bc2b4b48c31124e6dde3b83a52b41aa59355f697416cec0e8420926636'
+# Iconfix set (SnapMetal icon-pixels-next, ADRENO_CS_TABLES): the settings-icons rows plus the executable 11d5ff9a
+# (CoreImage compute kernels get SP_CS_CONFIG NTEX = NSAMP = their T#/S# count, as Mesa programs them;
+# ADRENO_CS_TABLES=0 in a process's environment keeps the settings-icons counts), deployed by
+# tools/deploy-guest-plugin.py, and the icon-pixels probe 25f07e86 that tools/run-icon-pixels.py pushes; the
+# settings-icons set remains for rollback as ADDITIONS_SETTINGSICONS.
+ADDITIONS = 'build/current-assets/metal-stage-iconfix-20261024/trust-additions.json'
+ADDITIONS_SHA = '501a90b6e6fe79b346bcb81c1bddee315ae9fbe3d369ff6b5f44b115aeecc4de'
+TRUST_PAYLOAD = 'build/current-assets/metal-stage-iconfix-20261024/trustcache.payload'
+TRUST_SHA = '7857aabcda2814974193c24dbc3245312c3ba02d1de46848b8be60a332571af0'
+ADDITIONS_SETTINGSICONS = 'build/current-assets/metal-stage-settingsicons-20261024/trust-additions.json'
+ADDITIONS_SETTINGSICONS_SHA = 'cdc784df778f7544fac5b2c774c3b6ee49cc70a15670301f3c4515dfed5562ff'
+TRUST_PAYLOAD_SETTINGSICONS = 'build/current-assets/metal-stage-settingsicons-20261024/trustcache.payload'
+TRUST_SHA_SETTINGSICONS = '247598bc2b4b48c31124e6dde3b83a52b41aa59355f697416cec0e8420926636'
 ADDITIONS_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trust-additions.json'
 ADDITIONS_MIRRORSLAB_SHA = '4802847aef13e6e46ebc50cd03b1e35ebafe929d5ae46f44f4de6a8d4fb64ae7'
 TRUST_PAYLOAD_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trustcache.payload'

tools/deploy-guest-plugin.py

@@ -113,6 +113,10 @@ MIRRORSLAB = ROOT / 'build/current-assets/metal-stage-mirrorslab-20261021'
 # inside System Settings panes; multi-input kernels only when the kext publishes AdrenoIBComputeSamplers): only the
 # executable changes, over the mirror-slab 758535d9; runtime v7 and its CodeResources stay installed.
 SETTINGSICONS = ROOT / 'build/current-assets/metal-stage-settingsicons-20261024'
+# Iconfix set (SnapMetal icon-pixels-next: ADRENO_SETTINGS_ICONS plus ADRENO_CS_TABLES, built with ADRENO_LENIENT=1
+# ADRENO_PIPELINE=1 and runtime v7: CoreImage's compute kernels get Mesa's SP_CS_CONFIG texture/sampler/UAV counts):
+# only the executable changes, over the settings-icons 378ff525; runtime v7 and its CodeResources stay installed.
+ICONFIX = ROOT / 'build/current-assets/metal-stage-iconfix-20261024'
 PREVIOUS = ASSETS
 ORIGINAL = ROOT / 'build/current-assets/metal-stage/AdrenoMetal.bundle/Contents'
 CONTENTS = 'System/Volumes/Data/Library/GPUBundles/AdrenoMetal.bundle/Contents'
@@ -122,9 +126,9 @@ FILES = [   # installed in this order: the executable last
          patch=WSABORT / 'libAdrenoCompiler-059fcc6e.bsdiff', cdhash='ab4ccbd4806696e30cbe8ca6f8ff271e89cea7cd'),
     dict(name='CodeResources', path=f'{CONTENTS}/_CodeSignature/CodeResources',
          base=COMPILESPEED / 'CodeResources', new=WSABORT / 'CodeResources', patch=None, cdhash=None),
-    dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=MIRRORSLAB / 'AdrenoMetal',
-         new=SETTINGSICONS / 'AdrenoMetal', patch=SETTINGSICONS / 'AdrenoMetal-758535d9.bsdiff',
-         cdhash='c76a4677c74623d78f51f578cc4f2978ea73ff26'),
+    dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=SETTINGSICONS / 'AdrenoMetal',
+         new=ICONFIX / 'AdrenoMetal', patch=ICONFIX / 'AdrenoMetal-378ff525.bsdiff',
+         cdhash='11d5ff9ae3c796ef3ac5c9fec5853e0f8deaec7b'),
 ]
 PLUGIN, BASE, NEW, NEW_CDHASH = FILES[-1]['path'], FILES[-1]['base'], FILES[-1]['new'], FILES[-1]['cdhash']
 WORK = 'System/Volumes/Data/private/var/tmp/snapintosh-plugin'