fix(firmware): correct identity and secure OTA provisioning for 0.8.14

[ruvnet]

ESP32-C6 onboarding passed a six-byte buffer to an IDF API that can write an eight-byte EUI-64, corrupting the buffer and dropping board-unique MAC bytes from the digest. This uses the six-byte base-MAC API while preserving the existing PSA SHA-256 algorithm and wire format. The production function is shared with a focused host regression test; no custom crypto or tracked firmware binary is added.

OTA authentication also lacked its documented provisioning path. --ota-psk-file now reads a bounded, regular secret file and validates exactly 64 hex characters; --ota-psk remains available with an argv/history warning. The key reaches only the requested credential-bearing NVS artifact/device, never host state or diagnostics. State retains a nonsecret configured marker, so subsequent writes require resupplying the key or explicitly using --clear-ota-psk. Legacy cached keys are hidden on read and removed on the next successful state write; inspection does not modify the file. POSIX permissions are checked; Windows ACL protection remains the operator's responsibility.

Prepare source version 0.8.14 because the separate 0.8.13 prerelease tag already exists. CMake derives its project version from version.txt. Firmware CI now gates publication on provisioning tests and verifies the built application descriptor before packaging. Published tag builds default to prerelease, with CI-only qualification stated explicitly. Existing historical binaries remain unchanged and carry their own snapshot metadata. Download instructions use the current three archive names and distinguish display/headless configurations.

Validation performed locally:

• python -m unittest discover -s firmware/esp32-csi-node/tests -p 'test_provision*.py': 71 tests, 60 passed and 11 POSIX-only skips on Windows.
• python firmware/esp32-csi-node/test/test_delivery_contract.py: 4 passed, including historical snapshot version/checksums and malformed app descriptors.
• MSVC C11 /W4 /WX compilation and execution of test_onboarding_identity.c: passed; verifies six-byte hash input, adjacent MAC tails, formatting, and MAC/PSA failure paths with synthetic seams.
• Workflow YAML validation, edited local documentation links, and git diff --check: passed.

Full S3/C6 builds, Linux host tests, POSIX secret-file checks, and the IDF 6 canary remain CI gates. No hardware was flashed, and no new physical-board or sensing-accuracy validation is claimed. Corrected C6 identities require rediscovery/reselection of boards that previously used the colliding digest. No release tag is created by this PR.

Provenance: the narrow MAC correction follows #1942/#1984 and the ESP-IDF 5.4 MAC API implementation; OTA requirements reconcile #1753/#1760/#1832 while leaving unrelated remote-sleep and wider state-secret changes out. Firmware README link/UDP guidance incorporates the firmware portions of #2236/#2242.

Fixes #1942. Fixes #1753. Related: #1899, #2092.