render: build the oracle heading from the path it reports on

The four leak-oracle rows in the verbose block took their heading from
kasld_oracle_labels[], a second array keyed by the same index as
kasld_oracle_paths[]. Swapping two entries reported one source's
readability under another's heading — a wrong claim about the reader's
privilege — and nothing caught it: the gatherer test pins each path to
its own probe, not a heading to its path.

Every label was "Readable " + the path + ":", so the array carried
nothing the path did not already say, and text.c was its only reader.
The JSON and markdown blocks name the path itself alongside the same
readability bit, which is why they never consulted it and why a heading
is not a property of an oracle. The heading is now composed where it is
printed, next to the check_files rows that already work that way, and
the array is gone.

Author: bcoles

src/environment.c

@@ -159,9 +159,6 @@ static void read_hardening_state(struct kasld_hardening *h) {
 
 const char *const kasld_oracle_paths[KASLD_N_ORACLES] = {
     "/proc/kallsyms", "/proc/kcore", "/proc/iomem", "/proc/modules"};
-const char *const kasld_oracle_labels[KASLD_N_ORACLES] = {
-    "Readable /proc/kallsyms:", "Readable /proc/kcore:",
-    "Readable /proc/iomem:", "Readable /proc/modules:"};
 
 /* Held-cap → the kasld leak it unlocks. Bit numbers are the stable capability
  * ABI (linux/capability.h): CAP_SYS_RAWIO=17, CAP_SYS_ADMIN=21, CAP_SYSLOG=34,

src/include/kasld/internal.h

@@ -795,8 +795,6 @@ struct kasld_hardening {
 #define KASLD_N_ORACLES 4
 extern const char *const
     kasld_oracle_paths[KASLD_N_ORACLES]; /* /proc/kallsyms… */
-extern const char *const
-    kasld_oracle_labels[KASLD_N_ORACLES]; /* "Readable …:" */
 
 /* SELinux runtime mode, read from /sys/fs/selinux/enforce. Absent covers both
  * "SELinux is not built in" and "selinuxfs is not reachable from here" — which

src/render/text.c

@@ -2590,9 +2590,13 @@ void render_system_config(void) {
    * log/debug/boot sources. */
   for (int i = 0; i < KASLD_N_ORACLES; i++) {
     int readable = vant->oracle_readable[i];
-    printf("%-30s%s%s%s\n", kasld_oracle_labels[i],
-           readable ? c(C_GREEN) : c(C_DIM), readable ? "yes" : "no",
-           c(C_RESET));
+    /* The heading is built from the path it reports on, so a row cannot come
+     * to name one source while answering for another. The other formats name
+     * the path itself, which is why no heading is carried alongside it. */
+    char label[64];
+    snprintf(label, sizeof(label), "Readable %s:", kasld_oracle_paths[i]);
+    printf("%-30s%s%s%s\n", label, readable ? c(C_GREEN) : c(C_DIM),
+           readable ? "yes" : "no", c(C_RESET));
   }
 
   const char *check_files[][2] = {