cycle: trust and deploy the settings-icons plug-in set

The next installed run boots with the mirror-slab executable 758535d9
installed and must replace it with SnapMetal's ADRENO_SETTINGS_ICONS
build (lenient, ADRENO_PIPELINE, runtime v7: AdrenoMetal 378ff525,
CDHash c76a4677) from single-user mode.

installed_fresh: the trust additions become the settings-icons set's
(the mirror-slab set's 46 rows plus c76a4677: cdc784df, payload
247598bc); the mirror-slab set stays as ADDITIONS_MIRRORSLAB for
rollback, and every earlier CDHash stays trusted, so --restore still
boots. deploy-guest-plugin: the executable's base is the mirror-slab
758535d9 and its payload the 36,670-byte AdrenoMetal-758535d9.bsdiff;
the runtime and CodeResources are already the installed (wsabort) ones
and are skipped.

The set, build/current-assets/metal-stage-settingsicons-20261024, is a
local (ignored) input: AdrenoMetal, AdrenoMetal-758535d9.bsdiff,
trust-additions.json, trustcache.payload and SET.json.

Evidence: the prepare-time trust check (configure_guest, then
trust_cache_spec(ADDITIONS).load(FIRMWARE) against TRUST_PAYLOAD and
TRUST_SHA) passes for the installed, -input and -input-touchpad
profiles, for this set and the mirror-slab rollback;
tools/test-deploy-guest-plugin.py PASS 21 checks (install, again,
restore, refuse) over the console stand-in with 3% loss.

tools/cycle_lib/installed_fresh.py

@@ -318,10 +318,17 @@ QCC2072_INPUTS = 'qcc2072-inputs'        # under the attempt's directory: the th
 # no CP_MEMCPY over 1 MiB, after b12v13's 4 MiB copy latched the GPU); the pipeline set remains as ADDITIONS_PIPELINE.
 # Mirror-slab set (agents/gpu-perf FAILURE-MODES.md R): the pipeline2 rows plus the executable 933060b2 (UBO mirror regions
 # from slabs allocated once and never released); the pipeline2 set remains for rollback as ADDITIONS_PIPELINE2.
-ADDITIONS = 'build/current-assets/metal-stage-mirrorslab-20261021/trust-additions.json'
-ADDITIONS_SHA = '4802847aef13e6e46ebc50cd03b1e35ebafe929d5ae46f44f4de6a8d4fb64ae7'
-TRUST_PAYLOAD = 'build/current-assets/metal-stage-mirrorslab-20261021/trustcache.payload'
-TRUST_SHA = 'fb429aa20cea252f321d3b4ff18d7bc9425c10babb391d370315c9de5b4ff50f'
+# Settings-icons set (SnapMetal ADRENO_SETTINGS_ICONS): the mirror-slab rows plus the executable c76a4677 (CoreImage
+# compute kernels sampling sRGB and grey+alpha images; multi-input kernels behind AdrenoIBComputeSamplers), deployed by
+# tools/deploy-guest-plugin.py; the mirror-slab set remains for rollback as ADDITIONS_MIRRORSLAB.
+ADDITIONS = 'build/current-assets/metal-stage-settingsicons-20261024/trust-additions.json'
+ADDITIONS_SHA = 'cdc784df778f7544fac5b2c774c3b6ee49cc70a15670301f3c4515dfed5562ff'
+TRUST_PAYLOAD = 'build/current-assets/metal-stage-settingsicons-20261024/trustcache.payload'
+TRUST_SHA = '247598bc2b4b48c31124e6dde3b83a52b41aa59355f697416cec0e8420926636'
+ADDITIONS_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trust-additions.json'
+ADDITIONS_MIRRORSLAB_SHA = '4802847aef13e6e46ebc50cd03b1e35ebafe929d5ae46f44f4de6a8d4fb64ae7'
+TRUST_PAYLOAD_MIRRORSLAB = 'build/current-assets/metal-stage-mirrorslab-20261021/trustcache.payload'
+TRUST_SHA_MIRRORSLAB = 'fb429aa20cea252f321d3b4ff18d7bc9425c10babb391d370315c9de5b4ff50f'
 ADDITIONS_PIPELINE2 = 'build/current-assets/metal-stage-pipeline2-20261021/trust-additions.json'
 ADDITIONS_PIPELINE2_SHA = 'eb035ef6ff2a380ece5ace3eddd9d9bc1365d9a8a478ba25ede795d8ccf5e119'
 TRUST_PAYLOAD_PIPELINE2 = 'build/current-assets/metal-stage-pipeline2-20261021/trustcache.payload'

tools/deploy-guest-plugin.py

@@ -108,6 +108,11 @@ PIPELINE2 = ROOT / 'build/current-assets/metal-stage-pipeline2-20261021'
 # again; b12v16's SPTM UPDATE_DISJOINT_MULTIPAGE x13): only the executable changes, over pipeline2's 8f712c36; runtime v7
 # and its CodeResources stay installed.
 MIRRORSLAB = ROOT / 'build/current-assets/metal-stage-mirrorslab-20261021'
+# Settings-icons set (SnapMetal ADRENO_SETTINGS_ICONS, built with ADRENO_LENIENT=1 ADRENO_PIPELINE=1 and runtime v7:
+# CoreImage compute kernels that sample sRGB and grey+alpha images, iconservicesagent's icns, device and document icons
+# inside System Settings panes; multi-input kernels only when the kext publishes AdrenoIBComputeSamplers): only the
+# executable changes, over the mirror-slab 758535d9; runtime v7 and its CodeResources stay installed.
+SETTINGSICONS = ROOT / 'build/current-assets/metal-stage-settingsicons-20261024'
 PREVIOUS = ASSETS
 ORIGINAL = ROOT / 'build/current-assets/metal-stage/AdrenoMetal.bundle/Contents'
 CONTENTS = 'System/Volumes/Data/Library/GPUBundles/AdrenoMetal.bundle/Contents'
@@ -117,9 +122,9 @@ FILES = [   # installed in this order: the executable last
          patch=WSABORT / 'libAdrenoCompiler-059fcc6e.bsdiff', cdhash='ab4ccbd4806696e30cbe8ca6f8ff271e89cea7cd'),
     dict(name='CodeResources', path=f'{CONTENTS}/_CodeSignature/CodeResources',
          base=COMPILESPEED / 'CodeResources', new=WSABORT / 'CodeResources', patch=None, cdhash=None),
-    dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=PIPELINE2 / 'AdrenoMetal',
-         new=MIRRORSLAB / 'AdrenoMetal', patch=MIRRORSLAB / 'AdrenoMetal-8f712c36.bsdiff',
-         cdhash='933060b2a88ca8437625ae75283dc6e7b02cf1ad'),
+    dict(name='AdrenoMetal', path=f'{CONTENTS}/MacOS/AdrenoMetal', base=MIRRORSLAB / 'AdrenoMetal',
+         new=SETTINGSICONS / 'AdrenoMetal', patch=SETTINGSICONS / 'AdrenoMetal-758535d9.bsdiff',
+         cdhash='c76a4677c74623d78f51f578cc4f2978ea73ff26'),
 ]
 PLUGIN, BASE, NEW, NEW_CDHASH = FILES[-1]['path'], FILES[-1]['base'], FILES[-1]['new'], FILES[-1]['cdhash']
 WORK = 'System/Volumes/Data/private/var/tmp/snapintosh-plugin'