fix: audit pass 2 — diagnostic-frame checksum + 8 more findings - #72

staticcheck ./... reports SA1019 deprecation warnings across
production packages (cmd/lintool, ldf, master, slave) and tests that
still consume the deprecated lin.MaxID/lin.MaxDataLen aliases instead
of LINMaxID/LINMaxDataLen. go vet is clean so CI's vet gate doesn't
catch this class of issue.

Addresses go-LIN-03.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>

The Software Accomplishment Summary marked SVP.md, SCMP.md, and
SQAP.md as "not found" and asserted 6 gaps / 14/20 evidence items,
though all three files exist at the repo root. Correct the presence
column, gap count/list, and completeness assertion to match actual
repo contents (17/20, 3 remaining gaps).

Addresses go-LIN-04.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>

The project-structure table listed a transport/ directory (physical-
layer serial/UART abstraction) that does not exist anywhere in the
repo.

Addresses go-LIN-05.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>

linNode.Send validated only the frame ID and forwarded straight to
bus.Publish, which never checked len(data) against LINMaxDataLen —
RELAY spec section 10.1 requires ErrPayloadTooLarge here, but the
already-defined sentinel was unreachable on this path. Add the length
check to linNode.Send.

Also: an out-of-range/unparseable msg.ID was wrapped as
ErrNotConnected, a connection-state sentinel, for what is a structural
violation. FromMessage already returns ErrInvalidFrame for the same
condition; make Send consistent with it.

Addresses go-LIN-06 and go-LIN-09.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>

SG-02 ("detect frame payload corruption using the LIN checksum") was
allocated to REQ-LIN-004, which is the PID-parity requirement
(ProtectID carries //fusa:req REQ-LIN-004). The checksum logic
(CalcChecksum) is REQ-LIN-008/009/010; SG-02 traced to the wrong
requirement and to no checksum requirement at all.

Addresses go-LIN-07.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>

Every hazard's declared asil was one band above what its own
severity/exposure/controllability fields yield under the standard
ISO 26262 Part 3 ASIL determination table: H-01..H-04 (S2/E3/C2)
yield ASIL-A, not the declared ASIL-B; H-05 (S1/E3/C2) and H-06
(S2/E2/C2) yield QM, not the declared ASIL-A. SG-01/02/05 inherited
the inflated ASIL-B from H-01/03 and H-02/04.

Recomputed independently against the standard S/E/C -> ASIL lookup
(not the repo's apparent sum-based shortcut) and confirmed the same
corrected values, so this is a genuine miscalculation, not a
deliberate conservative up-rating.

Note: HARA.md's own SG ASIL summary table (lines 36-40) still shows
the old ASIL-B/ASIL-A values and is now inconsistent with this file;
that document-level reconciliation is tracked separately as an open
item (go-LIN-08) and is out of scope here, which touches only the
machine-readable .fusa-hara.json S/E/C -> ASIL computation.

Addresses go-LIN-N2-01.

Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>