FABRIC-3.md §I.4: magic-number content-type detection, closing Milestone 6

Closes both remaining Milestone 6 (PKI) punch-list items.

Signature-status column: doc-only closure -- the underlying need was
already redirected to capsules/BLOCK_MAP.md's real Signed column
(2026-08-26); checking the box off as moot-as-worded rather than
leaving an accurate-but-permanently-unchecked marker.

Magic-number content-type detection (Section U item 14): built in
tools/mkcapsule.c. detect_content_type() classifies a file's actual
leading bytes (TTF/OpenType sfnt tags, DER's 0x30 SEQUENCE tag, or a
printable-ASCII/TAB/CR/LF heuristic for text) against
expected_type_from_ext()'s .4th/.md/.der/.ttf mapping; process_file()
warns on mismatch, never refuses -- same WARN-first rollout this
project already used for capsule signing. Verified against every real
capsule in the repo (38 files) with zero false positives. This is the
shared primitive Milestone 7's contrib-capsule validation can reuse
next.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground); logs and DoE CSVs from this session's verification runs
included per this repo's own audit-artifact convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

FABRIC-3.md

@@ -817,7 +817,7 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   call sites in `capsule_birth.c` (lines 472, 551, 747), backed by `capsule_sig.c`. Every
   capsule in `capsules/BLOCK_MAP.md`'s manifest shows `Signed: yes`.
 
-- [ ] Extend `MANIFEST_AUTO.md`'s generation to add a signature-status column, matching the
+- [x] Extend `MANIFEST_AUTO.md`'s generation to add a signature-status column, matching the
   existing xxHash64 column's generation pattern. **INVESTIGATED 2026-09-03, left unchecked on
   purpose — redirected, not done as literally worded.** This document's own later text (Phase
   8 close-out) explicitly decided `MANIFEST_AUTO.md` is "stale/dead, not regenerated since
@@ -825,10 +825,14 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   real `Signed` column (`| Capsule | Blocks claimed | xxHash64 | Signed |`, values `yes`/`no`
   per capsule). The underlying goal is met; the specific file this item names deliberately
   never was touched, so the box stays unchecked as a marker that this exact wording is now
-  moot rather than pretending the literal ask was fulfilled.
+  moot rather than pretending the literal ask was fulfilled. **CLOSED 2026-09-04**: checked
+  off as moot-as-worded, doc-only, per §I.4's matching closure note.
 
-- [ ] Implement magic-number-based content-type detection (Section U item 14) — a shared
-  primitive, also usable for Milestone 4's foreign-drive check.
+- [x] Implement magic-number-based content-type detection (Section U item 14) — a shared
+  primitive, also usable for Milestone 4's foreign-drive check. **DONE 2026-09-04**: built as
+  `detect_content_type()`/`expected_type_from_ext()` in `tools/mkcapsule.c`, wired into
+  `process_file()` as a WARN-only extension-vs-actual-bytes cross-check. See §I.4's closure
+  note for the full description.
 
 - [x] **Root CA + snakeoil intermediate generated 2026-08-26**, entirely offline, in a sibling
   directory outside this repo (`/home/rajames/CLionProjects/lithosananke-ca/`, not tracked by
@@ -981,7 +985,8 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   reverted) clean on all three, zero warnings, conservation intact, real disk untouched.
 
   **Milestone 6 is now fully closed** except magic-number content-type detection (shared with
-  Milestone 4, genuinely separate scope, not started).
+  Milestone 4, genuinely separate scope, not started). **CLOSED 2026-09-04**: see §I.4 —
+  Milestone 6 has no open items left at all now.
 
 ### From FABRIC-2.md §X, Milestone 7 — Contributor capsules / trust tiers
 
@@ -4436,16 +4441,31 @@ stale the way the original carry-forwards did.
   pointer below); verified 3-arch boot to `ok>`. *(Full entry:
   §A, "From FABRIC-2.md §X, Milestone 5 — Console/VM key-match binding.")*
 
-### I.4 — Milestone 6 remainder (PKI)
+### I.4 — Milestone 6 remainder (PKI) — CLOSED 2026-09-04
 
-- [ ] **`MANIFEST_AUTO.md` signature-status column.** Investigated 2026-09-03, left unchecked
+- [x] **`MANIFEST_AUTO.md` signature-status column.** Investigated 2026-09-03, left unchecked
   on purpose: this document's own Phase 8 close-out already redirected the underlying need to
   `capsules/BLOCK_MAP.md`'s real `Signed` column instead — the goal is met, the literal file
   this item names was never touched. Box stays open as an accurate "moot as worded" marker,
-  not a real remaining task. *(Full entry: §A, "From FABRIC-2.md §X, Milestone 6 — Kernel/
-  capsule PKI signing chain.")*
-- [ ] **Magic-number content-type detection.** Not started — shared scope with Milestone 4's
-  foreign-drive check and Milestone 7 below. *(Same location as above.)*
+  not a real remaining task. **Closed 2026-09-04 as exactly that: doc-only, no code** — the
+  box now reflects that the underlying need was already met, rather than leaving an
+  accurate-but-permanently-unchecked marker forever. *(Full entry: §A, "From FABRIC-2.md §X,
+  Milestone 6 — Kernel/capsule PKI signing chain.")*
+- [x] **Magic-number content-type detection.** Not started — shared scope with Milestone 4's
+  foreign-drive check and Milestone 7 below. **DONE 2026-09-04**: built in `tools/mkcapsule.c`
+  (a host build-time tool, not kernel code — no 3-arch boot dependency for the check itself,
+  though the full acceptance pass still ran since it's on the build's own critical path).
+  `detect_content_type()` classifies a file's actual leading bytes into one of this project's
+  four known capsule content shapes (TTF/OpenType sfnt tags, DER's `0x30` SEQUENCE tag, or a
+  printable-ASCII/TAB/CR/LF heuristic for text); `expected_type_from_ext()` maps `.4th`/`.md`/
+  `.der`/`.ttf` to what they should be. `process_file()` cross-checks the two and **WARNs on
+  mismatch, never refuses** — same WARN-first rollout discipline this project already used for
+  capsule signing (§ Milestone 6 above) before any hard-refuse flip. Verified against every
+  real capsule in this repo (38 files, all four extensions represented) on a full clean 3-arch
+  build: zero false-positive warnings. This is the shared primitive both Milestone 4's
+  foreign-drive check (already independently satisfied by `homeblocks_sig_check()`'s
+  structural check, so not itself a new consumer) and Milestone 7's contrib-capsule validation
+  (§I.5, next) can reuse. *(Same location as above.)*
 
 ### I.5 — Milestone 7 (contributor capsules / trust tiers) — nothing started