Make RX3 setup configurable and usable from a fresh checkout

[xsploit]

A fresh clone previously stopped at firmware recovery or failed on missing DRM headers, with the remaining runtime assembly and machine-specific paths left to the reader. This adds one ./rx3 workflow and a human setup guide: recover official inputs, assemble the chroot, build/install a matched 1.19 player/shim, configure devices, validate, start and stop.

• Central config for paths, account/groups, DRM/touch devices, ALSA card, MIDI mapping/port and USB UUID. Pinned public FLX6 mapping fetch removes the dependency on the original owner's home folder.
• Streaming, checksum-verified recovery with resumable downloads and actionable failures; confined runtime writes preserve firmware symlinks and reject path escapes. Interrupted assembly can resume.
• Build prerequisites include libdrm/pkg-config; runtime manifests and ELF dependency checks detect missing/mismatched files. Startup checks and scoped stop handling avoid taking over unrelated installations. Original music is mounted read-only; local library copies are tied to USB UUID.
• Preserve research history separately, document migration/limitations, retain compatibility wrapper names. No firmware/player/library/key/music binaries included.

Validation: fresh source copy in a path containing spaces; official ZIP recovery, assembly twice, native helpers plus ARM32 cross-build, patch/install/validate, then idempotent setup --offline. Fresh setup --dry-run created no outputs. selftest passes 21 Python tests, seven replay suites and nine C tests. The existing frame stress test's scheduling-dependent assertion was replaced with a full final-frame check while retaining contention/mixed-frame checks. Test environment details are in docs/SETUP-VALIDATION.md.

Draft pending physical acceptance: Pi stayed off. Target remains Pi 5 + 1200x1920 portrait panel + FLX6; fresh boot, audio/cue, physical touch/MIDI, USB, stop/restart and unplug behavior still need verification. This does not solve waveform flicker or claim universal hardware support. 1.19 is the supported pin, not a claim that it is the latest firmware. Do not merge on offline evidence alone.