feat(esp): evidence-based loopTask stack bound + ADR-034 (closes #276)

[cofade]

Completes issue #276: the stack-budget fix merged in #277 cleared the observed overflow, but 16384 was an unmeasured bound. This branch turns it into an evidence-backed, permanently instrumented budget.

What ships

• Firmware instrumentation (ESP32-CAM.ino) — permanent [stack] loopTask high-water-mark log line after every heavy stage: ota_manifest, geolocation, register, boot_heartbeat, setup_complete, and first_upload (loop()). uxTaskGetStackHighWaterMark(NULL) reports the running minimum of the loopTask, so each stage's line both records and attributes the peak.
• Measured evidence (real hardware) — bench ESP32-CAM (MAC 68:09:47:60:33:08), production URLs, miner seq 9, on 2026-09-02:
  • watermark reached 6428 of 16384 bytes free during the OTA-manifest TLS fetch (the firmware: setup() crash-loops on real hardware — mbedTLS handshake in the OTA manifest fetch overflows the 8 KB loopTask stack (stack canary panic); module never registers #276 crasher); no later stage took it lower — live Google TLS handshake (forced via the 14-boot geo-cache TTL), registration TLS POST, boot heartbeat TLS POST, first image-upload TLS POST (200 after retries)
  • TLS path runs ~3.6 KB deeper than the no-TLS baseline (10048 free on a boot whose manifest connect failed, so no handshake ran)
  • peak ~9.96 KB, ~6.4 KB headroom, so 16384 stays — now evidence-backed
• ADR-034 — decision: one global loopTask budget + per-boot instrumentation, not a per-call-site dedicated TLS task.
• Docs — esp-reliability section 9 measured numbers; firmware-release checklist re-verify now greps the [stack] lines (with the first_upload success-only caveat); chapter 10 names the hardware smoke-flash as the only gate for this defect class; chapter-11 lesson updated from "not a measured bound" to measured; troubleshooting healthy-boot signature includes the watermark.

Gates

• pio run -e esp32cam: green
• pio test -e native: 291/291 (WSL host gcc)
• check-doc-citations: 0 problems; check-agent-context: OK
• Senior-reviewer: 3 rounds, clean (no P0/P1), explicitly no further rounds needed

Not in this PR

• No SEQUENCE/VERSION bump — reaching the field requires the SEQUENCE-bumped OTA release per firmware-release.md (belongs to the firmware: setTimeout() unit bug (seconds on core 2.0.17), captive-portal loops without deadline/WDT feed, and a fixed OTA download deadline — one SEQUENCE-bumped release #231 package; this instrumentation rides it).
• The bench module was left configured to production (heartbeat/upload 200; manifest 404 is setup wizard cannot flash on production: /firmware.bin, /firmware.app.bin and /firmware.json are all missing from the live host #275; registration returned an nginx 405 on prod — both statuses arrived after the completed TLS handshake, so the stack depth was measured regardless). The module created no production row (registration 405), so no admin cleanup is needed.

Manual test needed: none beyond the hardware measurement already performed; the release checklist's bench-boot re-verify covers the ongoing tripwire.