Hand over the M3a plan: 22 tasks, their files, and the check record

Task files, the files they copy in (byte-identical to the reference on
m3a-ref), each area's check record, and a README with the per-task
table of what each check exposed. The handoff note is done with.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/plans/M3a/files/Makefile-task21

@@ -0,0 +1,30 @@
+# Boxmaker gate. `make gate` must pass before any work is called done. It needs no network.
+
+.PHONY: gate audit verify-device
+
+gate:
+	cargo fmt --all --check
+	cargo clippy --workspace --all-targets --locked --offline -- -D warnings
+	cargo test --workspace --locked --offline
+	cargo deny --offline check bans licenses sources
+	sh scripts/check-lines.sh
+	sh scripts/check-crate-deps.sh
+	sh scripts/check-dep-docs.sh
+	sh scripts/check-runbook.sh
+	sh scripts/test-gate-scripts.sh
+	@echo "gate: ok"
+
+# Fetches the RustSec advisory database. Listed in docs/egress.md.
+audit:
+	cargo deny check advisories
+
+# Checks that need straylight. They go through a private inferproxy to the real server.
+# Override the server with: make verify-device UPSTREAM=host:port
+UPSTREAM ?= straylight:11434
+
+verify-device:
+	cargo build --workspace --locked
+	BOXMAKER_INFERPROXY=$(CURDIR)/target/debug/inferproxy BOXMAKER_BXCTL=$(CURDIR)/target/debug/bxctl \
+		BOXMAKER_UPSTREAM=$(UPSTREAM) \
+		cargo test -p loopd --test device --locked -- --ignored --test-threads=1
+	@echo "verify-device: ok"