feat: create firmware skeleton and reproducible build

PLANS.md

@@ -111,7 +111,7 @@ passport were repaired and reverified before returning the milestone to
 
 ## Milestone 002 — Firmware skeleton and reproducible build
 
-**Status:** `NOT_STARTED`
+**Status:** `COMPLETE`
 
 ### Objective
 
@@ -146,9 +146,48 @@ builds reproducibly with the locked platform and partition configuration.
 
 ### Evidence
 
-Completion evidence is not yet available because this milestone has not
-started. Required evidence includes clean build output, image sizes, asset
-reproducibility checks, and a target-board boot log.
+- On 2026-09-03, `/home/sasa/.platformio/penv/bin/pio project config` parsed
+  the updated configuration successfully with the locked platform, ESP-IDF,
+  4 MB Flash, root partition table, LittleFS, pinned `esp_littlefs`, bounded
+  LittleFS settings, and the build hook.
+- On 2026-09-03, `./scripts/run_host_tests.sh` reported
+  `health state tests: PASS` and
+  `web asset reproducibility: PASS
+  (611eacdb06b81bdb064a9074352ff4c6f82d3af3ad3d01e65705387744b86b21)`.
+- After `/home/sasa/.platformio/penv/bin/pio run --target clean`, running
+  `/home/sasa/.platformio/penv/bin/pio run` on 2026-09-03 completed with
+  `[SUCCESS]` in 43.10 seconds. PlatformIO reported 14,084 bytes of RAM and
+  350,232 of 2,097,152 application bytes in use. The independent build hook
+  reported `firmware.bin uses 350864/2097152 bytes in partition factory`.
+- Running `/home/sasa/.platformio/penv/bin/pio run --target buildfs` on
+  2026-09-03 regenerated `data/index.html.gz`, built the LittleFS image, and
+  reported `[SUCCESS]`. The independent build hook reported
+  `littlefs.bin uses 2031616/2031616 bytes in partition littlefs`; the image is
+  intentionally emitted at full partition size and contains the 683-byte
+  compressed application asset.
+- Two LittleFS builds separated by a clean produced the identical SHA-256
+  `ad203373be69f4541106b2d0dfd7096adb8132967ab49e2d23c391ede8f4d4f5`.
+  The generated gzip asset remained
+  `950c60077c381d4484c11b43762bc5c8378587b6cd91924c344cfbc406771bb9`.
+  Listing the image showed both file and image creation times normalized to
+  1970-01-01, demonstrating deterministic compression and packaging.
+- `strings .pio/build/esp32-c6-devkitm-1/firmware.bin` found firmware version
+  `0.2.0` and the startup log formats for version, LittleFS capacity, and health
+  state. This verifies their presence in the built artifact but is not a
+  substitute for target-board execution.
+- On 2026-09-03, `/home/sasa/.platformio/penv/bin/pio run --target uploadfs
+  --upload-port /dev/ttyACM0` wrote and hash-verified the 2,031,616-byte
+  LittleFS image at `0x210000`. A subsequent application upload identified the
+  target as `ESP32-C6FH4 (QFN32) (revision v0.2)` with embedded 4 MB Flash and
+  USB Serial/JTAG, wrote the 350,864-byte application image, and verified its
+  hash.
+- A target-board boot capture on 2026-09-03 reported `App version: 0.2.0`,
+  `SPI Flash Size : 4MB`,
+  `LittleFS mounted: total=2031616 bytes, used=12288 bytes`,
+  `HTTP server ready with static and health endpoints`, and
+  `Health state: serving`. The capture contained no application error after
+  startup. This supplies the physical-board evidence for acceptance criterion
+  5.
 
 ## Milestone 003 — Wi-Fi provisioning and persistent configuration