feat(firmware): integrate Binwalk and Unblob analysis

* feat(firmware): integrate Binwalk and Unblob analysis

* fix(firmware): verify published files and namespace source references

* test(firmware): isolate extractor dependency failure from process cleanup

* fix(firmware): retain actionable report and cleanup diagnostics

* test: assert retained batch output failure diagnostics

third_party/README.md

@@ -40,3 +40,21 @@ are checked against fixed SHA-256 values. Fixture provenance is recorded in
 `scripts/fixtures/android-apidemos.json`; the source uses Apache-2.0. This is a
 static analysis fixture: no emulator, device, SDK installation or app execution
 is needed. APKs and JARs are neither tracked nor included in npm packages.
+
+## Firmware engines
+
+| Engine | Source | Release | Pinned commit | License |
+| --- | --- | --- | --- | --- |
+| Binwalk | <https://github.com/ReFirmLabs/binwalk> | v3.1.0 | `4fdab3d464d97b68e0af9088df3f9e2e1545b21c` | MIT, upstream `LICENSE` |
+| Unblob | <https://github.com/onekey-sec/unblob> | 26.6.4 | `1fcc7a0a584a70a96c31f5a276c20944d199a089` | MIT, upstream `LICENSE` |
+
+Source remains unmodified in `third_party/binwalk` and `third_party/unblob`.
+Release records live in `src/firmware/FirmwareRelease.ts`; REA adapters own the
+CLI/report interpretation and lifecycle in `src/firmware/`. Caller-supplied
+executables retain their actual launcher digest and unknown source revision;
+version output alone does not establish source identity. REA does not bundle
+extractors or download/install firmware engines during analysis.
+
+On updates: inspect actual pinned CLI and report producers, preserve licenses,
+update gitlinks/release records, run report regressions and the real firmware
+lane. See [firmware setup and coverage](../docs/firmware-analysis.md).