Preserve the Brew Bubbles 2.2.3 PlatformIO build

[lbussy]

Summary

• preserve the canonical Brew Bubbles 2.2.3 firmware, LittleFS image, source archive, checksums, manifest, and flash procedure
• document the missing release-source commit and provide a deterministic reconstruction from the closest surviving public source
• pin the historical PlatformIO platform and every library dependency
• preserve the complete linux/amd64 container and offline toolchain as checksummed release assets
• add a network-disabled GitHub Actions reconstruction that validates firmware identity and LittleFS contents

Provenance limitation

The canonical firmware embeds commit 6362a76 on branch master, but that commit is absent from the surviving Git history. The reconstructed firmware therefore uses commit 3beff558e54862332a419fd5431d5ed59dd25a05 and is explicitly documented as non-canonical.

Verification

• canonical preserved/2.2.3/SHA256SUMS: all files OK
• offline local reconstruction: passed with Docker networking disabled
• deterministic reconstructed firmware: cfd41b647268a70c71090f621a44ad50d968a7cfba6dc5370d9849f59bf85f01
• reconstructed LittleFS extracted-file hashes: identical to canonical release
• external release assets: verified after GitHub upload/download round trip
• GitHub Actions run: https://github.com/lbussy/brew-bubbles/actions/runs/29944496411
• preservation release: https://github.com/lbussy/brew-bubbles/releases/tag/2.2.3-build-preservation

Hardware validation still required

This PR preserves and verifies the build, but does not replace testing on a physical D1 Mini. Provisioning, web UI, temperature sensors, cloud reporting, OTA behavior, and LittleFS operation should be exercised on hardware before declaring the preserved runtime fully validated.