[codex] Add verified app package installer

[n30nex]

Summary

• adds a verified stored-ZIP app package install transaction with exact byte-count and SHA256 checks before extraction
• extracts packages into hidden staging, rejects unsafe paths and unsupported compression, validates embedded manifest IDs, then promotes with rollback through the existing app install helpers
• exposes serial app package test and app package install <id> <path> <sha256> <bytes> plus a deterministic scripts/build_app_package.py helper
• documents the lower-level package format and keeps catalog download/UI integration listed as follow-up work
• carries the known no-stub esptool argument fix needed for COM8 artifact flashing

Validation

• git diff --check
• python -m py_compile scripts\build_app_package.py scripts\check_tdeck_budget.py scripts\fetch_tdeck_artifact.py scripts\serial_harness.py scripts\tdeck_smoke.py scripts\tdm_airtime_smoke.py scripts\validate_app_catalog.py scripts\validate_local_app_samples.py scripts\release_evidence.py
• python scripts\build_app_package.py examples\local-apps\weather-mesh --out .pio\weather-mesh-test.zip --device-path /sd/limitlezz/packages/weather.mesh.zip
• python scripts\validate_app_catalog.py docs\examples\app-catalog-index.json
• python scripts\validate_local_app_samples.py
• pio run -e native
• .pio\build\native\program.exe --selftest
• .pio\build\native\program.exe --simtest
• Upstream Firmware CI: https://github.com/ItsLimitlezz/LimitlezzOS/actions/runs/27878910101

Hardware

• Downloaded exact artifact: tdeck-meshcore-firmware-8706af9857c1f131c2b67007e51813051c402f25
• Manifest: env=tdeck-meshcore, meshcore_enabled=1, budget_status=pass, firmware_bytes=1586880, firmware_slot_pct=30.27, static_ram_bytes=230196
• Flashed COM8 only with no-stub upload; target ESP32-S3 rev v0.2 MAC cc:8d:a2:0d:14:28; all flash hashes verified
• Serial smoke passed: id, sys, app package test, app catalog test, net, airtime
• app package test: App package selftest: PASS version=2.0.0 files=3

[n30nex]

Hardware validation complete on COM8 for commit 8706af9857c1f131c2b67007e51813051c402f25.

• Upstream Firmware CI passed: https://github.com/ItsLimitlezz/LimitlezzOS/actions/runs/27878910101
• Downloaded artifact: tdeck-meshcore-firmware-8706af9857c1f131c2b67007e51813051c402f25
• Artifact manifest: env=tdeck-meshcore, meshcore_enabled=1, budget_status=pass, firmware_bytes=1586880, firmware_slot_pct=30.27, static_ram_bytes=230196
• Flashed COM8 only with no-stub upload; target ESP32-S3 rev v0.2 MAC cc:8d:a2:0d:14:28; all flash hashes verified
• Serial smoke passed:
  • id: !a20d1428 "limitlessdeck" (LIMI)
  • sys: battery 100%, USB, cpu 240MHz, ram 42/151KB
  • app package test: App package selftest: PASS version=2.0.0 files=3
  • app catalog test: App catalog selftest: PASS valid=2 invalid_error="bad sha256"
  • net: Meshtastic on, MeshCore on
  • airtime: Balanced MT 50% / MC 50%