audit: avr / framework-arduino-avr — does platform_packages override work? (parent #664) #667

Parent: #664 (full context, scope, motivation).

What to check

1. Open crates/fbuild-packages/src/library/arduino_core.rs — confirm the framework URL / commit / sha256 are pinned as const &str and that the only public constructor takes no override.
2. Open the orchestrator at crates/fbuild-build/src/avr/ — does it consult config.get_env_config(env_name)? for a platform_packages entry naming this framework, and pass the URL+ref through to a with_override constructor? Or does it only ever call the default constructor?
3. Reply on this issue with:
   • bug exists — if the orchestrator never reads platform_packages, plus file:line for both the const URL pin and the call site.
   • fixed / no bug — if an override path exists, plus file:line showing the lookup + override constructor.

Reference

#663 is the original report of this pattern (nxplpc). #664 lists every framework package being audited. Use the same evidence shape: file:line for the const URL pin and for the orchestrator call site.