[EdwardChamberlain]

Closes #40. Raise the per-file limit to 40 KiB, cap downloaded OTA JSON at 96 KiB (below the 128 KiB request ceiling), retain the 128 KiB decoded bundle cap, and check staging space using the filesystem's allocation block size and blocks available to the application, with a 48 KiB reserve. Add a validator using the device allowlist and limits.

The v1 release workflow uses the exact tested candidate artifact; PR #45's release artifact verifier validates its digest and device rules before publication.

Validation: 24 OTA tests passed, including differing filesystem block sizes; py_compile, flake8, git diff --check, and the generated 1.0.0 asset passed. ESP32-C3 upload, install, and rollback validation remains outstanding.

[EdwardChamberlain]

Code issues fixed in be843d0. OTA response/upload limits and per-file headroom remain enforced. Staging space now uses MicroPython statvfs allocation units and blocks available to the application; a regression uses different f_bsize/f_frsize values to catch an incorrect estimate. The validator checks the device allowlist and limits.

PR #45's release-artifact verifier validates the exact downloaded OTA asset and its recorded digest before publication, keeping this check compatible with the hardware-tested artifact workflow.

Validation: 24 focused OTA tests pass, including the differing-block-size case; flake8, compilation, diff checks, and the generated 1.0.0 asset pass. PR #45 CI is green; its checks apply to main after #45 lands.

Still needs hardware evidence: test a representative larger bundle, interruption, and rollback on ESP32-C3.