refactor: split toolchain.h and sys/__assert.h out of util.h

util.h was accreting symbols whose upstream homes are
<zephyr/toolchain.h> (likely/unlikely, __weak, ALWAYS_INLINE, __noinit)
and <zephyr/sys/__assert.h> (__ASSERT, __ASSERT_NO_MSG), while the repo
otherwise mirrors upstream include paths exactly -- the devlog TODO
already records a downstream smf port hand-editing upstream #includes
because of this. Thin headers at the upstream paths fix that now, while
they have 1-2 consumers; util.h re-includes both so existing ports keep
working.

Also two correctness fixes folded in:
- __noinit now maps to __NOINIT_ATTR (real .noinit on hardware, no-op
  on the linux target via esp_attr.h's CONFIG_IDF_TARGET_LINUX gate in
  both IDF v5.4 and v5.5). The old empty shim silently gave zero-init
  BSS semantics to any future warm-reset-retention user, and its
  stated Mach-O blocker was false -- the macOS host build of the linux
  target compiles clean.
- likely/unlikely now document the divergence from esp_compiler.h
  (ESP-IDF's are CONFIG_COMPILER_OPTIMIZATION_PERF-gated; Boreas
  matches upstream Zephyr's unconditional __builtin_expect; both are
  #ifndef-guarded so the include-order race is codegen-only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: swoisz

components/zkernel/include/boreas/zephyr/sys/__assert.h

@@ -0,0 +1,33 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright 2026 Intercreate
+ *
+ * Zephyr-compatible runtime assertions (upstream <zephyr/sys/__assert.h>
+ * spellings).
+ *
+ * Divergence: upstream compiles these out unless CONFIG_ASSERT=y
+ * (default n); Boreas keeps them always on -- they log and abort.
+ * NOT safe from IRAM ISR context (ESP_LOGE + abort are flash-resident).
+ * Use k_panic() (sys/util.h) for unrecoverable errors in ISR/IRAM
+ * context.
+ */
+
+#pragma once
+
+#ifndef __ASSERT
+#include <stdlib.h> /* abort() */
+
+#include "esp_log.h"
+#define __ASSERT(cond, msg)                                                                        \
+	do {                                                                                       \
+		if (!(cond)) {                                                                     \
+			ESP_LOGE("ASSERT", "%s at %s:%d", (msg), __FILE__, __LINE__);              \
+			abort();                                                                   \
+		}                                                                                  \
+	} while (0)
+#endif
+
+/* Assertion with no message (upstream spelling). */
+#ifndef __ASSERT_NO_MSG
+#define __ASSERT_NO_MSG(cond) __ASSERT((cond), "")
+#endif

components/zkernel/include/boreas/zephyr/sys/util.h

@@ -13,6 +13,12 @@
 
 #include "esp_attr.h"
 
+/* Compatibility re-exports: upstream code reaches these symbols through
+ * <zephyr/toolchain.h> and <zephyr/sys/__assert.h>, but historical
+ * Boreas ports include only this header -- keep both paths working. */
+#include "zephyr/sys/__assert.h"
+#include "zephyr/toolchain.h"
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -97,62 +103,6 @@ extern "C" {
 #define ALIGNED(x) __attribute__((__aligned__(x)))
 #endif
 
-/* Weak symbol */
-#ifndef __weak
-#define __weak __attribute__((__weak__))
-#endif
-
-/* Always inline — undef any prior definition to guarantee `inline` is present
- * (RISC-V GCC errors without it under -Werror=attributes). */
-#undef ALWAYS_INLINE
-#define ALWAYS_INLINE __attribute__((always_inline)) inline
-
-/* Runtime assertion -- logs and aborts.
- * NOT safe from IRAM ISR context (ESP_LOGE + abort are flash-resident).
- * Use k_panic() for unrecoverable errors in ISR/IRAM context. */
-#ifndef __ASSERT
-#include <stdlib.h> /* abort() */
-
-#include "esp_log.h"
-#define __ASSERT(cond, msg)                                                                        \
-	do {                                                                                       \
-		if (!(cond)) {                                                                     \
-			ESP_LOGE("ASSERT", "%s at %s:%d", (msg), __FILE__, __LINE__);              \
-			abort();                                                                   \
-		}                                                                                  \
-	} while (0)
-#endif
-
-/* Assertion with no message (upstream spelling). */
-#ifndef __ASSERT_NO_MSG
-#define __ASSERT_NO_MSG(cond) __ASSERT((cond), "")
-#endif
-
-/* Branch-prediction hints (upstream toolchain.h). */
-#ifndef likely
-#define likely(x) __builtin_expect(!!(x), 1)
-#endif
-#ifndef unlikely
-#define unlikely(x) __builtin_expect(!!(x), 0)
-#endif
-
-/* Upstream places __noinit data in a section the loader does not zero,
- * to save startup cost. Boreas maps it to ordinary zero-initialized BSS
- * rather than ESP-IDF's __NOINIT_ATTR (which is a `.noinit` section
- * attribute): for the only user, ring_buf, a RING_BUF_DECLARE'd buffer
- * has its indices zero-initialized by the struct's static initializer
- * and never reads buffer bytes it has not written, so no-init vs
- * zero-init is behaviorally invisible. Plain BSS also keeps the shim
- * free of a section attribute (which does not port cleanly to the
- * Mach-O host toolchain used for the linux test target).
- *
- * Known limitation: genuine no-init semantics are NOT provided -- code
- * that needs data left uninitialized (or retained across a warm reset)
- * must use ESP-IDF's __NOINIT_ATTR / RTC_NOINIT_ATTR directly. */
-#ifndef __noinit
-#define __noinit
-#endif
-
 /* IRAM-safe panic -- triggers an illegal-instruction exception caught by
  * the ESP-IDF panic handler (which is IRAM-resident). Produces a full
  * backtrace on UART and reboots. Safe to call from IRAM_ATTR ISR context.

components/zkernel/include/boreas/zephyr/toolchain.h

@@ -0,0 +1,50 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright 2026 Intercreate
+ *
+ * Zephyr-compatible toolchain shims (upstream <zephyr/toolchain.h>
+ * spellings), kept thin so near-verbatim ports can keep their upstream
+ * #include shape. All definitions are #ifndef-guarded: a TU that
+ * already got a definition elsewhere keeps the first one it saw.
+ */
+
+#pragma once
+
+#include "esp_attr.h"
+
+/* Branch-prediction hints.
+ * Divergence from ESP-IDF: esp_compiler.h defines likely/unlikely as
+ * plain (x) unless CONFIG_COMPILER_OPTIMIZATION_PERF is set; Boreas
+ * matches upstream Zephyr's unconditional __builtin_expect instead.
+ * Both definitions are #ifndef-guarded, so include order picks the
+ * winner per TU -- the difference is codegen-only (identical
+ * semantics either way). */
+#ifndef likely
+#define likely(x) __builtin_expect(!!(x), 1)
+#endif
+#ifndef unlikely
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#endif
+
+/* Weak symbol */
+#ifndef __weak
+#define __weak __attribute__((__weak__))
+#endif
+
+/* Always inline -- undef any prior definition to guarantee `inline` is
+ * present (RISC-V GCC errors without it under -Werror=attributes). */
+#undef ALWAYS_INLINE
+#define ALWAYS_INLINE __attribute__((always_inline)) inline
+
+/* Upstream places __noinit data in a section the loader does not zero
+ * (so it also survives a warm reset). Mapped to ESP-IDF's
+ * __NOINIT_ATTR: a genuine .noinit section on hardware targets, and a
+ * no-op on the linux/host test target (esp_attr.h's _SECTION_ATTR_IMPL
+ * expands to nothing under CONFIG_IDF_TARGET_LINUX), where __noinit
+ * data is ordinary zero-initialized BSS instead. Code that must retain
+ * data across a warm reset therefore cannot rely on this shim on the
+ * host target; on hardware, prefer RTC_NOINIT_ATTR when the data must
+ * also survive deep sleep. */
+#ifndef __noinit
+#define __noinit __NOINIT_ATTR
+#endif