validate_sof_install: Add SOF firmware & topology installation validator

Add validate_sof_install.py tool to verify, identify, and repair SOF
firmware, LLEXT modules, topology binaries, and debug tools installed on
target hosts against reference releases in sof-bin.

Key capabilities:
- Validation engine: Compares installed files, versions, symlinks, and
  MD5 checksums on local or remote (SSH) targets against release assets in
  sof-bin.
- Version & release identification (--identify): Scans target filesystems
  and resolves installed component versions using global release hash
  indexing.
- Binary manifest inspection (--manifest / -m): Extracts metadata
  directly from binaries (ADSP FW $AM1, CSS $MN2 BCD build dates,
  extended manifest XMan, Zephyr/SOF git tag banners, and ALSA topology
  CoSA ABI headers).
- Sub-row manifest diffs: On mismatch, outputs comparison sub-rows
  detailing Host vs Expected versions, build timestamps, and ABI levels.
- Repair engine (--fix, --dry-run): Automatically installs missing or
  mismatched files and recreates symlinks via local copy or SSH/SCP.
  Displays version and manifest transitions (from -> to) for each repair.
- Downgrade protection: Prevents downgrading installed packages unless
  explicitly allowed via --downgrade / --allow-downgrade flag.
- Automated tests: Comprehensive unit test suite covering repo discovery,
  MD5 matching, manifest parsing, fix operations, and downgrade prevention.

Author: lrgirdwo

.gitignore

@@ -4,3 +4,7 @@ reproducible_images/
 # caches
 /tests/refs/
 /tests/refs_extracted/
+__pycache__/
+*.pyc
+tests/__pycache__/
+

README.md

@@ -81,3 +81,50 @@ Remember that for `rsync` (and some versions of `cp`), a trailing slash
 in `srcdir/` is roughly equivalent to `srcdir/*` + `srcdir/.??*`  This
 is how a recursive `rsync` is always idempotent while a recursive `cp`
 is typically not.
+
+## Validating and Repairing an Installation with validate_sof_install.py
+
+To verify that the installed SOF firmware binaries, LLEXT dynamic modules,
+topologies, and userspace tools match a specific release in this repository
+using MD5 checksums:
+
+```bash
+# Identify versions of all installed SOF files on the filesystem
+./validate_sof_install.py --identify
+
+# Identify installed files with embedded binary manifest details (build date, ABI, git tags)
+./validate_sof_install.py --identify -p tgl --manifest
+
+# Identify installed files on remote DUT over SSH
+./validate_sof_install.py -i -p tgl --ssh root@spider
+
+# List available versions in sof-bin
+./validate_sof_install.py --list-versions
+
+# Validate a specific version on local /lib/firmware/intel (automatically displays manifest diffs on mismatch)
+./validate_sof_install.py --version v2.14.1
+
+# Validate with full manifest details shown for all files
+./validate_sof_install.py --version v2.14.1 --manifest
+
+# Validate only a specific platform (e.g. Tiger Lake on local host)
+./validate_sof_install.py --version v2.12 --platform tgl
+
+# Preview repairs without modifying files (--dry-run)
+./validate_sof_install.py --version v2.14.1 --platform tgl --fix --dry-run
+
+# Automatically repair/sync missing or mismatched files from sof-bin
+sudo ./validate_sof_install.py --version v2.14.1 --platform tgl --fix
+
+# Validate a remote DUT directly over SSH (supports remote --fix as well)
+./validate_sof_install.py --version v2.12 --platform tgl --ssh root@spider
+
+# Validate an offline rootfs (e.g. PXE NFS mount)
+./validate_sof_install.py --version v2.12 --platform tgl --target-root /srv/nfs/spider-rootfs
+
+# Generate a standalone md5sum manifest
+./validate_sof_install.py --version v2.14.1 --generate-md5 /tmp/v2.14.1-md5.txt
+```
+
+
+