Note why F_CPU is hardcoded, widen the plain linker-flag denylist

F_CPU gets the same drift-audit note as _MMU_DEFAULT: upstream reads it
from the board manifest, and all 45 supported boards ship 80000000L.
The plain-form refusal also covers -e, -s, -static, and -nostartfiles,
which gcc accepts inertly on a -c line.

esphome/build_gen/arduino8266.py

@@ -310,6 +310,9 @@ def _defines_flags(
     return [
         f"-D{d}"
         for d in (
+            # Upstream reads this from the board manifest (build.f_cpu); all
+            # 45 supported boards ship 80000000L, so the value is hardcoded
+            # here rather than drift (same rationale as _MMU_DEFAULT)
             "F_CPU=80000000L",
             "__ets__",
             "ICACHE_FLASH",
@@ -378,7 +381,9 @@ def _project_flags(
                 continue
             libs.append(tok[2:])
         else:
-            if tok == "-u" or tok.startswith(("-T", "-Xlinker")):
+            if tok in ("-u", "-e", "-s", "-static", "-nostartfiles") or tok.startswith(
+                ("-T", "-Xlinker")
+            ):
                 # Inert on the -c compile line; the firmware would silently
                 # lack the requested link behavior
                 raise EsphomeError(

tests/unit_tests/build_gen/test_arduino8266.py

@@ -697,7 +697,9 @@ def test_lexed_build_flags_shared_between_consumers(
     )
 
 
-@pytest.mark.parametrize("tok", ["-Tcustom.ld", "-Xlinker", "-u"])
+@pytest.mark.parametrize(
+    "tok", ["-Tcustom.ld", "-Xlinker", "-u", "-e", "-s", "-static", "-nostartfiles"]
+)
 def test_project_flags_rejects_plain_linker_forms(tok: str) -> None:
     """A plain-form linker flag would land on the -c compile line where it
     is inert; refuse naming the -Wl, form instead of shipping firmware that