[codex] Add OTA candidate cache and inactive-slot writer

[n30nex]

Summary

• extend Phase 10 OTA from a verified candidate cache into a guarded inactive-slot writer
• add ota write to write a verified cached candidate into the inactive OTA slot without changing boot selection
• add ota write-test to copy the currently running valid app image into the inactive OTA slot for hardware smoke proof
• keep boot-partition selection, reboot, health marking, rollback UX, update UI, and Feedback Manager progress as follow-up work
• make scripts/tdeck_smoke.py adapt to both modern hyphenated esptool syntax and this host's legacy underscore esptool 4.5.1 syntax

Validation

• git diff --check
• python -m py_compile scripts\fetch_tdeck_artifact.py scripts\release_evidence.py scripts\tdeck_smoke.py
• pio run -e native
• .pio\build\native\program.exe --selftest
• .pio\build\native\program.exe --simtest
• Context7 checked current esptool CLI docs; local PlatformIO esptool 4.5.1 uses legacy underscore reset/command names, so the smoke script now probes syntax.

Actions Artifact

• fork Firmware CI run: https://github.com/n30nex/LimitlezzOS/actions/runs/27887394012
• head: 1bf7aa71619e2487a4aa10162cdd3f1316dd8e49
• artifact: tdeck-firmware-1bf7aa71619e2487a4aa10162cdd3f1316dd8e49
• local artifact dir: .pio\ci-artifacts\tdeck-1bf7aa7-ota-install
• manifest: budget_status=pass, firmware_bytes=1721200, static_ram_bytes=231160, firmware_slot_pct=32.83
• note: base PR pull_request CI passed for efcc9dc before the script-only smoke harness fix; GitHub did not attach a duplicate base check for 1bf7aa7, but the fork Actions run above is green for the exact PR head.

Hardware: COM8 Only

• flashed exact artifact tdeck-firmware-1bf7aa7... to COM8 with no-stub esptool; bootloader, partitions, boot_app0, and firmware hashes verified
• target: ESP32-S3 rev v0.2, MAC cc:8d:a2:0d:14:28
• boot reached lz> with identity !a20d1428 "limitlessdeck" (LIMI)
• medium serial pass: id, sys, ota status, ota test, ota boot-test, ota write
  • ota status: no cached manifest, no candidate
  • ota test: OTA manifest selftest: PASS valid=1 invalid_error="bad sha256"
  • ota boot-test: OTA boot policy selftest: PASS
  • ota write: [err] no candidate; ota write: failed error="no candidate"
• inactive-slot writer pass: sys, ota write-test, sys, ota status
  • before: RAM 43/150KB, uptime 306s
  • ota write-test: [ok] OTA inactive-slot write selftest passed; boot unchanged
  • write result: source=running-copy running=ota_0 inactive=ota_1 addr=0x00510000 size=5242880 bytes=1721200 boot-set=no
  • after: RAM 43/150KB, uptime 312s

Notes

• COM11 and COM29 were not used.
• The download path still uses diagnostic trust semantics (http:// accepted; HTTPS transport currently insecure in this branch). Before promoting OTA beyond diagnostics, add signed manifests or pinned/CA-validated HTTPS.