Preserve Pull OTA LittleFS rollback

[ODevStudio]

Summary

• fetch the installed release's own signed manifest when it has aged out of the 10-entry latest catalog
• accept only exact-version, hardware-compatible, required LittleFS rollback metadata
• support both vX.Y.Z and X.Y.Z release tags without increasing the catalog or manifest limits
• remove the temporary Pull OTA heap diagnostics

Root cause

The bounded latest catalog can omit an older installed release, but Pull OTA requires that release's signed LittleFS URL, size, and SHA-256 before installation. Without it, the update aborts with Rollback missing even though compatible newer releases are available.

Impact

Firmware rollback still uses the existing second app slot. Only the shared LittleFS recovery metadata is fetched from the installed release's signed per-release manifest. If that manifest is missing, unsigned, mismatched, or incompatible, the update stops before writing firmware or LittleFS.

Validation

• python tools/test_generate_release_manifest.py
• python tools/test_pull_ota_contract.py
• python tools/test_ota_rollback_contract.py
• python tools/test_release_workflow_contract.py
• python tools/test_ota_public_key_header.py
• python tools/test_ai_docs_contract.py
• pio test -e native -f test_pull_ota_version
• pio run -e esp32s3
• git diff --check