Checked in, trunk 5535.
If you update, the check should run on the first boot, since even though it's not a clean install, the config value is new and starts with the default value.
I would obviously be interested to know if it breaks anything, or if anyone sees checksum failures.
The rebuild-firmware-crc rule should only need to be run if a new port is added or additional ranges are added to the checks. If you run batch-rebuild-firmware-crc, you should watch out (check svn diff) for subs added or removed due to not having the same set of dumps that I had.
The script requires python3. It shouldn't require any nonstandard packages or have other unusual requirements. If you don't have python available (it could be inconvenient on windows) and need to build a new port, you can create a firmware_crc_data.h with just #define FIRMWARE_CRC_DISABLED 1. You should not copy a firmware_crc_data.h from another port.