lua: restore MCU update over fabric

[cpunt]

Summary

This PR restores the MCU firmware update path over Fabric and tightens the OTA state machine around the failure modes seen during hardware testing.

It includes:

• authenticated firmware-update UI/API flow support;
• routing MCU staged updates through Fabric transfer/staging rather than ad-hoc paths;
• Fabric UART/session hardening for bad frames, session recovery, transfer sender progress, and retained-state replay;
• stricter MCU update reconcile semantics requiring post-reboot software, updater, and health facts;
• update staging/commit admission checks, clearer runtime failure reporting, and job-store timeout classification;
• cleanup of OTA readiness/admission behavior after rebasing onto the current migration-base.

Test Coverage Footprint

Diff against migration-base (git diff --numstat origin/migration-base...origin/fix/ui-e2e-auth):

• Total diff: 6,256 additions / 385 deletions.
• Test files under tests/: 3,482 additions / 61 deletions.
• Test-line changes total: 3,543 lines.
• Non-test files: 2,774 additions / 324 deletions.

Largest test additions are in Fabric transfer/session/IO coverage, device phase-2 coverage, and update artifact/reconcile/service coverage.

Notes

No wire protocol rename is intended here. The branch keeps the existing Fabric transfer protocol while making admission, replay, reconcile, and diagnostics stricter and more observable.