Wi-Fi data path FIXED: esp_hosted 2.12 on both chips + C6 SDIO auto-OTA

Root cause of the dead data path (assoc/scan/RPC fine, zero data
frames): esp-hosted 1.4.x is formally incompatible with IDF 5.5
(esp-hosted-mcu#47) and the factory C6 slave firmware was ancient
(couldn't even answer a version RPC). Waveshare's examples pin 1.4.* —
do not follow them.

Fix:
- host: espressif/esp_hosted ^2.12 (+ esp_wifi_remote 1.6)
- slave: 2.12.11 network_adapter.bin embedded in the app (c6_ota.c
  streams it to the C6 over the SDIO RPC channel at boot when the
  reported version is < 2.x; ~10s, no wires, idempotent)
- RAM diet for hosted 2.x's footprint (MEMPOOL_PREFER_SPIRAM,
  reduced WIFI_RMT buffers) — without it internal SRAM famine
  boot-loops in xTaskCreateStaticPinnedToCore before app_main
- conservative 20MHz SDIO clock for first verified data path

Verified on hardware: DHCP lease (even that healed), 8/8 pings to
router and tower-of-joy at 1-5ms, WebSocket to the gateway connected,
device registered at /devices as desklock-p4 with fw version.

Also: wifi_diag.c L1 SoftAP diagnostic mode (DESKLOCK-DIAG) with
review fixes, boot ping ladder in net.c, static-IP fallback,
face_status() line, docs for the whole failure taxonomy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -64,6 +64,25 @@ sg dialout -c "bash -lc 'source ~/esp-idf/export.sh >/dev/null && idf.py -p /dev
 
 - `sg dialout -c '…'` is needed because the login session predates the user's dialout
   membership; a plain `idf.py flash` works after any re-login.
+- **Radio stack: esp_hosted ≥ 2.x on BOTH chips, non-negotiable.** esp-hosted 1.x is
+  formally incompatible with IDF 5.5 (esp-hosted-mcu#47) — symptom: RPC/scan/connect
+  all work, but NO data frames ever flow (no DHCP, no ARP, no ping). Waveshare's
+  examples pin 1.4.* and the factory C6 slave firmware is ancient — both wrong. The
+  host manifest pins `espressif/esp_hosted: "^2.12"`; the matching slave image is
+  embedded as `main/c6_slave.bin` and `c6_ota.c` flashes the C6 **over SDIO** at boot
+  whenever the C6 reports a version < 2.x (build a new bin from the component's
+  `slave/` project for esp32c6 when bumping versions).
+- **Internal-RAM famine assert**: `assert failed: xTaskCreateStaticPinnedToCore …
+  xPortcheckValidStackMem` in a pre-app_main boot loop means static+early allocations
+  starved internal SRAM (hosted 2.x is hungry). Keep
+  `CONFIG_ESP_HOSTED_MEMPOOL_PREFER_SPIRAM=y` and the reduced `WIFI_RMT_*` buffer
+  counts in sdkconfig.defaults; check `heap_init:` pool lines when the binary grows.
+- SDIO clock is set conservatively (`CONFIG_ESP_HOSTED_SDIO_CLOCK_FREQ_KHZ=20000`),
+  ample for 16 kHz voice; raising to 40 MHz is untested on this board's data path.
+- **L1 driver diagnosis mode**: set `WIFI_DIAG_MODE 1` in desklock_main.c — the device
+  becomes AP `DESKLOCK-DIAG` (pass `desklock123`, page at http://192.168.4.1/) proving
+  radio+SDIO+IP with zero external network variables. Ladder: L0 SDIO control → L1
+  softap data → L2 STA to any network → L3 STA to "Outside" → L4 gateway.
 - **PSRAM must run at 200 MHz** or the 800×800 MIPI-DSI framebuffer underruns
   (`lcd.dsi.dpi: can't fetch data…` spam, LVGL lock never frees, task watchdog).
   `CONFIG_SPIRAM_SPEED_200M` only takes effect together with