Pin BusyBox od and hexdump notices

[jacklv-coder]

Summary

• pin exact BusyBox source evidence for the enabled od, hexdump, and hd applets
• update RootFS v0.3.3 compliance manifests, generated checksums, bilingual documentation, and changelogs
• extend validator coverage so the four reviewed source files and 92-file candidate bundle remain reproducible

Validation

• ./Scripts/test.sh (139 tests, 1 expected environment-only skip)
• Ruby validator test suites (all passing)
• compliance generators in write and --check modes
• RootFS manifest and SHA-256 verification
• POCKETROOT_ROOTFS_ARCHIVE=/private/tmp/pocketroot-license-audit.wLbK0L/fs.tar.gz swift test --filter testPinnedReleaseArchiveWhenProvidedByEnvironment
• pre-push codex review --uncommitted (no findings)

[jacklv-coder]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: d3abe349ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".