audit: arduino_api — does platform_packages override work? (parent #664) #666

Parent: #664 (full context, scope, motivation).

What to check

1. Open crates/fbuild-packages/src/library/arduino_api.rs — confirm the framework URL / commit / sha256 are pinned as const &str and that the only public constructor takes no override.
2. Open the orchestrator at crates/fbuild-build/src/ — does it consult config.get_env_config(env_name)? for a platform_packages entry naming this framework, and pass the URL+ref through to a with_override constructor? Or does it only ever call the default constructor?
3. Reply on this issue with:
   • bug exists — if the orchestrator never reads platform_packages, plus file:line for both the const URL pin and the call site. (may be consumed by multiple orchestrators — search for ArduinoApi::)
   • fixed / no bug — if an override path exists, plus file:line showing the lookup + override constructor.

Reference

#663 is the original report of this pattern (nxplpc). #664 lists every framework package being audited. Use the same evidence shape: file:line for the const URL pin and for the orchestrator call site.