Add unblob so REA can extract firmware

unblob 26.6.4 (the version REA is verified with) is installed from its
PyPI wheel into /opt/unblob, with dependencies pinned to its uv.lock at
the release commit. A wrapper puts that venv first on PATH, and
REA_UNBLOB_COMMAND points REA's extract_firmware at it.

Its extractors follow upstream's install-deps.sh: Ubuntu packages,
sasquatch v4.5.1-6 (also used by binwalk) and onekey-sec's e2fsprogs
fork, whose debugfs rdump options the ext2/3/4 handler needs. The build
checks that unblob finds every extractor.

The uv.lock converter moves to scripts/ and skips the locked project
itself generically, since ghidra-mcp and unblob both use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/uvlock-to-constraints.py

@@ -0,0 +1,25 @@
+"""Print pip constraints (name==version) for every package in a uv.lock.
+
+Used at image build time to install a Python tool's release wheel
+(ghidra-mcp, unblob) with the exact dependency versions its upstream lock
+file was tested with. The locked project itself (source "editable"/"virtual"
+at ".") is skipped; it is installed from the wheel. A package that uv
+resolved differently per Python version appears more than once; those
+entries carry their resolution markers, so pip applies only the one that
+matches the interpreter.
+"""
+import sys
+import tomllib
+
+with open(sys.argv[1], "rb") as f:
+    lock = tomllib.load(f)
+
+for package in lock["package"]:
+    source = package.get("source", {})
+    if source.get("editable") == "." or source.get("virtual") == ".":
+        continue
+    line = f'{package["name"]}=={package["version"]}'
+    markers = package.get("resolution-markers")
+    if markers:
+        line += " ; " + " or ".join(f"({m})" for m in markers)
+    print(line)