Fix sensor fault handling, harden OTA release signing, and bump firmware to 0.6.3

[MacNite]

Motivation

• Prevent false-positive sensor readings where short or stale captures advertise full-scale audio or zero vibration, which can mislead backend detectors.
• Improve OTA throughput by using the same fast BLE connection parameters used for audio, and reduce the deployment risk of using the SDK's public MCUboot development key.
• Keep versioning single-sourced and ensure release automation cannot produce deployable artifacts signed with the public development key.

Description

• In mic.c ensure the microphone measurement is only marked valid after FFT bands are actually computed by skipping m->mic_ok and returning early when fft_count < 64, and log the short-capture case.
• In accel.c make sample_xyz() fail the sample on a data-ready timeout (return false) instead of falling through to read stale registers so accel_read() rejects short captures.
• In audio.c add explicit nonce validity tracking (nonce_usable), make rotate_nonce() fail closed on RNG errors (advertise an inert nonce and log), and have authenticate() reject START while the nonce is unusable.
• In ota.c after link_claim(LINK_OWNER_OTA) request the same faster BLE parameters used by audio (short interval units, max data length and 2M PHY) while preserving synchronous write-with-response flash flow control.
• Bump the single-source firmware patch version in src/hive_config.h from 0.6.2 to 0.6.3 and correct the advertising-interval comment to say the device is connectable.
• Harden release signing and docs: update sysbuild/mcuboot.conf comment and make .github/workflows/release.yml require a HIVEINSIDE_SIGNING_KEY_PEM secret, write it securely to the runner, pass it into the sysbuild with -DSB_CONFIG_BOOT_SIGNATURE_KEY_FILE=..., and verify MCUboot selected it before accepting artifacts.
• Promote the signing-key provisioning steps into docs/ota-over-ble.md and docs/flashing.md, and keep the ota_init() filter-accept-list TODO referenced as the remaining coordinated work with HiveHub.

Testing

• Parsed the release workflow YAML with Ruby (ruby -e 'require "yaml"; YAML.parse_file(".github/workflows/release.yml")') and it succeeded.
• Ran repository single-source and retired-front-end invariants (find/test checks for prj.conf, app.overlay, absence of platformio.ini/zephyr/parts) and they passed.
• Executed Python assertions that verify the firmware version is now 0.6.3 and that the release workflow includes the signing-key guard; these assertions passed.
• Ran git diff --check and other repository checks (rg/sed/nl inspections used during the rollout) with no failures; note that full west --sysbuild builds for both variants were not executed in this environment because west is not installed.

---

Codex Task