Enforce v1.0.0 validation and coverage gates

[EdwardChamberlain]

Closes #41.

Changes

• Run the full pytest suite and flake8 on pull requests and pushes to main.
• Enforce at least 25% coverage in every Python module under micro/, src/, and scripts/, with at least 70% overall; upload the per-file report.
• Build and smoke-test wheel and source distributions, plus the Windows and macOS setup applications.
• Validate OTA candidates during CI and, before publication, revalidate the exact downloaded OTA release asset against device limits and the application allowlist while checking its recorded digest.
• Re-run the same quality workflow for release tags and require the tag to point at current main.
• Block release publication until a hardware rehearsal record passes for the exact release commit and tag.

Validation

• The updated PR's GitHub CI run is in progress.
• Locally, 125 tests passed when excluding the two GUI modules that require the unavailable FreeSimpleGUI dependency; flake8, compileall, and git diff --check passed.
• The local environment lacks coverage.py, so the per-file coverage gate is being checked by CI.
• ESP32-C3 rehearsal and Windows/macOS hardware install checks remain pending; the checked-in release record intentionally keeps v1 publishing blocked until those are completed.

[EdwardChamberlain]

Updated implementation at 2d1c15d. The release artifact verifier now checks the recorded digest and revalidates the exact downloaded OTA JSON against the device size limits and file allowlist. Runtime test doubles cover the config-readiness and plate-clear reconciliation APIs used by the other launch fixes.

Validation: GitHub CI run 36048467858 passes Quality, Windows desktop smoke, and macOS desktop smoke. The combined candidate passes 125 tests excluding the two GUI modules that require unavailable local FreeSimpleGUI; local flake8, compilation, and diff checks pass. The local environment lacks coverage.py; CI runs and passes the per-file coverage gate.

Still blocks v1 publication: complete the ESP32-C3 rehearsal and test the Windows and macOS candidate tools with the board, then record artifact digests and results in docs/release-validation.json.