Pin BusyBox ash math notices

[jacklv-coder]

What changed

• pin BusyBox 1.36.1 shell/math.c as exact license and attribution evidence
• bind the existing Alpine busyboxconfig and BusyBox shell/Kbuild.src facts to the enabled ash arithmetic module
• advance the reviewed evidence set from 21 to 22 files and the external candidate tree from 81 to 82 payloads
• keep broader BusyBox third-party notice coverage, legal review, and redistribution approval open

Why

The pinned Alpine configuration enables CONFIG_ASH, CONFIG_FEATURE_SH_MATH, and CONFIG_FEATURE_SH_MATH_64. BusyBox links math.o under that configuration, and shell/math.c retains complete MIT and BSD-3-Clause copyright and license notices. This closes only that bounded engineering item without overstating overall BusyBox coverage.

Validation

• materialized and verified the 22-file license-review bundle
• materialized and verified the 82-file external candidate bundle
• verified candidate tree SHA-256 b0a7ffeb09f02b3b751a4cf29dbb8ce65658b60c70316ea3c295c7bdb8360349
• all six Ruby compliance test suites
• reproducible 13-file compliance generator check
• bilingual documentation and SHA256SUMS checks
• ./Scripts/test.sh: 139 tests, 0 failures, 1 environment skip
• real pinned RootFS integration test: passed
• Codex CR: no P1/P2 findings

[jacklv-coder]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 5aa9cc001d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".