Add explicit Dig2Go peer firmware propagation

[theysayheygreg]

Summary

Adds an explicitly commanded Dig2Go-to-Dig2Go update path, separate from ordinary laptop fleet OTA.

A controller starts one chosen seed with an exact-target Fleet Update Propagate command:

P<release>,0.0.0.0,0,0,<target-device-id>,<nonce>,,

This is the same command path used by the five-device bench test. It starts the selected source directly; it does not enter ordinary OTA selection and does not require a button.

The chosen source then:

• serves its exact running application image to at most two Dig2Gos, sequentially;
• emits both the deployed legacy wake and the modern FleetUpdateOffer;
• uses no compiled MAC binding or laptop-managed receiver roster;
• leaves saved Wi-Fi credentials unchanged;
• uses the standard TubesOTA network for legacy-only sessions and a RAM-only Tubes-<nonce> network for mixed modern turns; and
• restores normal WLED/Tubes operation after completing or timing out.

A successfully updated modern receiver stores a durable, at-most-once baton before reboot. After reboot it receives one bounded propagation turn, allowing the update to continue without a post-reboot acknowledgment or laptop coordinator.

Ordinary server-backed fleet OTA remains the separate Y command and does not implicitly start propagation.

Physical evidence

Bench testing demonstrated:

• A → B: a known legacy receiver migrated.
• A → C: a previously unknown receiver migrated without MAC registration.
• A → C + D: two receivers were served sequentially in one turn.
• Five-device modern run: A updated C and E from v47 to v48, then E passed the baton to D.
• The updated active application slots on C, D, and E were each read back twice and matched the served image SHA-256 exactly.

Verification

• bash test/tubes_mesh/run.sh
• node --test tools/fleet-update-protocol-test.js
• pio run -e esp32_quinled_dig2go_tubes
• pio run -e esp32_quinled_dig2go_tubes_p2p
• Whole-PR git diff --check

Coverage includes explicit propagation-command separation from ordinary OTA, legacy wire compatibility, rendezvous and host lifecycle, HTTP range serving, exact running-image inspection, target validation, two-receiver fanout, modern offer validation, lease claim/replay prevention, and failed-pull radio recovery.

The existing Python 3.14 50-client fleet-server test issue is unchanged and reproduces on origin/main; this PR does not introduce it.

Current limits

• Final S3/Easy Flash command UX remains separate work; both should issue this explicit propagation command only after user input.
• C3 propagation is intentionally deferred.
• Unbounded tree depth, apartment-scale RF behavior, and a final post-integration physical smoke are not claimed.

[SteveEisner]

Reviewed against current main and resolved all merge conflicts. I fixed two reliability issues during review: marker-write failures now retry on a bounded 60-second cadence instead of every main-loop iteration, and the peer MAC parser now bounds its input scan. I found no remaining blocking code issues.

Local verification passed: npm build/tests (50/50), the full Tubes mesh host-test suite, the fleet-update protocol tests, and the esp32_quinled_dig2go_tubes_p2p firmware build (85.3% flash). I did not repeat the documented physical multi-device propagation run in this review.