feat(maze): add deterministic symmetric maze generation

PLANS.md

@@ -362,11 +362,11 @@ observers, and an owner-controlled lobby.
   snapshots. The observer protocol exposes no mutating command, while start
   authorization is resolved from the server-owned session and player slot.
 - These results provide concrete host and physical-device evidence for all six
-  acceptance criteria. Milestone 005 remains `NOT_STARTED`.
+  acceptance criteria.
 
 ## Milestone 005 — Symmetric maze generation and validation
 
-**Status:** `NOT_STARTED`
+**Status:** `COMPLETE`
 
 ### Objective
 
@@ -400,9 +400,66 @@ object placement and bounded memory use.
 
 ### Evidence
 
-Completion evidence is not yet available because this milestone has not
-started. Required evidence includes deterministic seed-test results, validator
-statistics, memory measurements, and representative generated maps.
+- On 2026-09-04, `/home/sasa/.platformio/penv/bin/pio project config` exited
+  successfully and resolved the production, Milestone 003 device-test, and
+  isolated `milestone-005-device-test` environments from the locked
+  `espressif32@7.0.1`, ESP-IDF, 4 MB Flash, root partition, and root sdkconfig
+  baseline.
+- On 2026-09-04, `./scripts/run_host_tests.sh` reported all preceding tests as
+  `PASS`, `maze bounded regeneration failure: PASS (3/3 attempts)`, and
+  `maze seed sweep: PASS (1024 seeds, combined hash=a264b7d133f8bad4)`.
+  Generating every default `128 x 64` seed twice produced identical hashes and
+  valid results. All 1,024 maps contained 8,192 reachable cells, exactly 133
+  cycles, six cross-half connections, 704–854 dead ends, and symmetric object
+  and route metrics. Start-to-key distances were 416–1,442, key-to-exit
+  distances were 346–1,244, and start-to-exit distances were 102–992; every
+  tested candidate succeeded on its first bounded attempt and key-search route
+  distance was never shorter than the following exit-search route distance.
+- The same host suite reported a maximum 5.127 ms generation time and
+  `maze fixed memory: PASS (42332/65536 bytes, no heap API)`. The portable
+  component uses one byte of passage flags per cell plus fixed bit-set,
+  traversal, distance, and placement arrays. A separate build with
+  `-fsanitize=address,undefined` and `ASAN_OPTIONS=detect_leaks=0` repeated the
+  1,024-seed suite without an address or undefined-behavior finding; leak
+  detection was disabled because the sandbox executes under `ptrace`.
+- Validator corruption tests independently rejected a broken reciprocal or
+  rotational passage and a colliding key placement. The sweep also verified
+  boundary starts and exits, keys outside each owner's Chebyshev-radius-three
+  initial view, corresponding distances for keys, exits, compasses, all eight
+  landmark pairs, and all four vision-artifact pairs. The forced impossible
+  candidate stopped after the configured three attempts and returned a
+  diagnostic failure instead of retrying indefinitely.
+- The deterministic small-map diagnostic reported representative map hash
+  `7396c6426181da3e` and printed a complete `16 x 8` ASCII maze with walls,
+  opposite starts, symmetric keys and exits, compasses, landmarks, and four
+  vision artifacts. `docs/MAZE_GENERATION.md` records the construction,
+  validation, configuration, reproducibility, and resource contracts.
+- `/home/sasa/.platformio/penv/bin/pio run -e esp32-c6-devkitm-1` completed
+  with `[SUCCESS]`. PlatformIO reported 47,508 of 327,680 RAM bytes and
+  1,005,274 of 2,097,152 application bytes in use; the production upload's
+  independent partition check reported
+  `firmware.bin uses 1005904/2097152 bytes in partition factory`.
+  `/home/sasa/.platformio/penv/bin/pio run -e esp32-c6-devkitm-1 --target
+  buildfs` also completed with `[SUCCESS]` and reported
+  `littlefs.bin uses 2031616/2031616 bytes in partition littlefs`.
+- The isolated physical-board image was built and hash-verified with
+  `/home/sasa/.platformio/penv/bin/pio run -e milestone-005-device-test
+  --target upload --upload-port /dev/ttyACM0`. The upload identified the target
+  as an ESP32-C6FH4 with 4 MB embedded Flash. On target, requested seed
+  `1513226245` generated in one attempt with hash `485280a746e8900c` and logged
+  `cells=8192, reachable=8192, edges=8324, cycles=133, crossings=6,
+  dead_ends=778, branches=1024`. Paired route metrics were equal:
+  `start_key=804/804`, `key_exit=773/773`, `start_exit=191/191`,
+  `compass=223/223`, `landmarks=3099/3099`, and `artifacts=1085/1085`.
+- The same physical run logged
+  `fixed=42332/65536 bytes, runtime=183/250 ms, heap_delta=0` followed by
+  `M005 physical maze test: PASS`. Production firmware was restored and
+  hash-verified afterward; a live `GET /health` over the configured station
+  network returned
+  `{"status":"serving","healthy":true,"version":"0.5.0","errorCode":0}`.
+- These deterministic, validator, resource, representative-map, build, and
+  physical-board results provide concrete evidence for all six acceptance
+  criteria. Milestone 006 remains `NOT_STARTED`.
 
 ## Milestone 006 — Authoritative movement and visibility core