P2.3: add resource and reproducibility gates

[MichalMatu]

Summary

• add absolute RAM and flash budgets from the green P2.2 build
• reuse the same full PlatformIO build report for the resource gate instead of launching a second size/build pass
• add host regression tests for PlatformIO resource-report parsing and budget overflow
• require the frontend lockfile for firmware builds
• verify generated web assets are reproducible across clean consecutive builds
• split verification into firmware/resource, host-test, web, static-analysis and docs gates
• keep every gate runnable locally through scripts/quality.sh
• finalize the P2.3 limits and verification contract in docs/P2_SCOPE.md

No USB NCM, Wi-Fi, NVS, endpoint or frontend feature behavior is changed.

Final verification note

The hosted Actions quota is currently unavailable, so the final tooling-only fix cannot receive another hosted run. On the same PR, the full firmware build had already completed successfully before the original resource-budget step failed. The resource parser was then corrected to consume that build report directly. Its regression tests pass independently, including ANSI/comma-formatted PlatformIO summaries and over-budget failure behavior, and the updated POSIX quality script passes shell syntax validation. The final commits after the successful firmware build modify only verification tooling/tests/docs/CI, not firmware runtime sources.