feat: nl_mkimage prüft Images mit --verify

deploy.sh soll kein Image auf die Station schieben, das jede Lampe
ablehnen würde. Die Prüfung sitzt in nl_mkimage, weil dort das
Trailer-Layout ohnehin steht - eine zweite Kopie derselben Offsets
wäre genau die Doppelung, die beim Abweichen jedes Update killt.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

tools/mkimage/test_nl_mkimage.py

@@ -53,3 +53,50 @@ def test_refuses_image_that_already_has_a_trailer(tmp_path):
     )
     assert r.returncode != 0
     assert "trailer" in r.stderr
+
+
+def verify(path, *extra):
+    return subprocess.run(
+        [sys.executable, str(SCRIPT), "--verify", str(path), *extra],
+        capture_output=True, text=True,
+    )
+
+
+def test_verify_accepts_a_good_image(tmp_path):
+    _, out = build(tmp_path, device="e27_rgb", version="1.2.3")
+    r = verify(out)
+    assert r.returncode == 0, r.stderr
+    assert r.stdout.split()[:2] == ["e27_rgb", "1.2.3"]
+
+
+def test_verify_rejects_a_file_without_trailer(tmp_path):
+    p = tmp_path / "plain.img"
+    p.write_bytes(b"x" * 5000)
+    r = verify(p)
+    assert r.returncode == 1
+    assert "trailer" in r.stderr.lower()
+
+
+def test_verify_rejects_a_corrupted_payload(tmp_path):
+    _, out = build(tmp_path)
+    d = bytearray(out.read_bytes())
+    d[100] ^= 0x01
+    out.write_bytes(d)
+    r = verify(out)
+    assert r.returncode == 1
+    assert "sha256" in r.stderr.lower()
+
+
+def test_verify_checks_the_expected_device(tmp_path):
+    _, out = build(tmp_path, device="evk")
+    assert verify(out, "--expect-device", "evk").returncode == 0
+    r = verify(out, "--expect-device", "g95_cw")
+    assert r.returncode == 1
+    assert "evk" in r.stderr and "g95_cw" in r.stderr
+
+
+def test_verify_rejects_a_file_shorter_than_the_trailer(tmp_path):
+    p = tmp_path / "tiny.img"
+    p.write_bytes(b"NINL" + b"\x00" * 10)
+    r = verify(p)
+    assert r.returncode == 1