docs(kernel): explain 6.18.34 source pin

[kkroo]

Summary

Documents the deliberate kernel source/version decisions that were called out in Ally review 4628256791 on #3.

• 6.18.34 remains pinned to match the deployed signed amt-kmod vermagic
• cdn.kernel.org no longer serves the numbered 6.18.34 release tarball
• the stable.git snapshot is accepted only when both reviewed hashes match

This is comment-only; build inputs are unchanged.

Validation

• git diff --check
• reviewed the rendered diff at both the version pin and source URL

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.

Looks good. This is a comment-only documentation PR (2 lines added across Pkgfile and kernel/prepare/pkg.yaml, no functional/build changes) explaining the deliberate 6.18.34 kernel source pin, as requested in the prior Ally review on #3.

Verified against the actual source:

• The linux_version/linux_sha256/linux_sha512 vars in Pkgfile are both used in kernel/prepare/pkg.yaml's sources block (sha256 and sha512 fields), confirming the new comment's "accepted only when both reviewed hashes match" claim is accurate to the code, not just asserted.
• The source URL is https://git.kernel.org/.../snapshot/linux-{{ .linux_version }}.tar.gz (git.kernel.org snapshot), consistent with the comment's claim that the numbered cdn.kernel.org release tarball is no longer used/available.

Strengths

• Directly addresses reviewer-requested context from the prior PR rather than leaving tribal knowledge undocumented.
• Comments are placed right at the pinned values they explain, so they'll stay adjacent to future renovate-bot version bumps.

Recommended Action

None — no Critical or Important findings.

Reviewed head: bb64ea8