build: pureboot rides as a pinned submodule, and the libavr pin advances

pureboot moved to its own repo, so the loader this board hands over to stopped
being reachable through a sibling checkout of the bootloader repo. It is a
submodule here now: this board has no reset line and no programming header, so
the resident loader is the only way in, and the commit naming the firmware
should name the loader it has to reach.

The reachability check stops carrying its own copy of where that loader is.
0x7e00 was a literal beside pureboot's own geometry, which the submodule
exports as PUREBOOT_BASE_HEX - one source for the fact now, and the check reads
whichever slot the pinned loader actually has. The boot-section bound stays a
literal, being a fuse fact rather than a loader one.

Built and tested at both pins on the bench: 5/5, cross-mode identity included,
and the image deployed to the board verifies byte-for-byte through its loader.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/check_reachability.py

@@ -35,8 +35,7 @@ import re
 import subprocess
 import sys
 
-BOOT_SECTION = 0x7C00  # hfuse d4: BOOTSZ 512 words
-LOADER_BASE = 0x7E00  # pureboot's 512-byte slot, at the top
+BOOT_SECTION = 0x7C00  # hfuse d4: BOOTSZ 512 words - a fuse fact, not a loader one
 WDTCSR = 0x60
 
 
@@ -45,7 +44,12 @@ def main() -> int:
     parser.add_argument("--objdump", required=True)
     parser.add_argument("--elf", type=pathlib.Path, required=True)
     parser.add_argument("--image", type=pathlib.Path, required=True)
+    # pureboot's own geometry, from the pinned submodule that exports it, so the
+    # slot's base is stated once for the loader this firmware is deployed with.
+    parser.add_argument("--loader-base", required=True,
+                        type=lambda v: int(v, 0), metavar="ADDR")
     args = parser.parse_args()
+    loader_base = args.loader_base
 
     failures = []
 
@@ -81,17 +85,17 @@ def main() -> int:
         if "r24" in held and "r25" in held:
             sites.append(held["r25"] << 8 | held["r24"])
 
-    want = LOADER_BASE // 2
+    want = loader_base // 2
     if not sites:
         failures.append("no call to bootloader::call with a loaded target - the "
                         "hand-over could not be read out of the image")
     elif wrong := [a for a in sites if a != want]:
         failures.append(f"the hand-over targets word {[hex(a) for a in wrong]} "
                         f"(byte {[hex(a * 2) for a in wrong]}), not the loader at "
-                        f"0x{LOADER_BASE:04x}")
+                        f"0x{loader_base:04x}")
     else:
         print(f"  ok    all {len(sites)} hand-over site(s) target word 0x{want:04x} "
-              f"(byte 0x{LOADER_BASE:04x})")
+              f"(byte 0x{loader_base:04x})")
 
     # An icall/ijmp has to exist for that address to be jumped to indirectly.
     if not re.search(r"\b(icall|ijmp)\b", text):