Add fleet updater foundations with C3 and S3 support

[theysayheygreg]

The idea

WLEDTubes has hundreds of controllers in the wild. This PR prepares a practical way to move that fleet forward without plugging every Tube into a laptop.

1. Future updates can move from Tube to Tube

After devices are running the new firmware, one updated Tube can pass an approved update to one compatible Tube nearby. The receiver installs it, restarts, and proves it is healthy before the baton moves on. If nothing suitable appears for 60 seconds, propagation stops.

2. The old fleet migrates with the tools it already understands

The existing Tubes do not know the new targeting and baton rules. Easy Flash installs the bridge firmware on the first device, and the established laptop-assisted OTA workflow moves nearby legacy devices onto the new release. The S3 is the on-site recovery surface for devices missed before a rave.

Keep the Tubes you want to update plugged in and in range until the update finishes.

3. Rollout happens in growing groups

Start with Greg's four devices, including an interrupted transfer and retry. Then update a small group before moving to the larger fleet. A device counts as updated only after it restarts and returns healthy. Powered-off, absent, or out-of-range devices remain unknown and can be handled in another pass.

Three reviewable commits

1. 0987e266 adds the shared target, artifact, session, migration, and 60-second baton foundations.
2. 89ea7a04 adds the exact Athom ESP32-C3 firmware target and update admission.
3. 1343f099 adds the Waveshare ESP32-S3 product shell, local Conductor, bounded Surveyor evidence, updater/recovery states, virtual framebuffer safety, partition contract, and compile canary.

Current boundary

This remains a draft because the final target-addressed wire seam and receiver OTA integration are not yet present. The S3 UI is compile-tested, but physical display, touch, radio, and live update behavior have not been exercised. This PR does not claim a completed field updater, contact a device, or alter the deployed Tubes packet IDs.

Supersedes #67 and #66 while retaining those branches and discussions for history.

[theysayheygreg]

Replacement target-only PR is now open as draft: #70. It contains the clean three-commit sequence with exact Waveshare S3 target scope; closing this superseded PR.

[theysayheygreg]

Superseded by replacement draft PR #70 with the corrected clean three-commit S3 target-only scope.