Wi-Fi data path FIXED: esp_hosted 2.12 on both chips + C6 SDIO auto-OTA

Root cause of the dead data path (assoc/scan/RPC fine, zero data
frames): esp-hosted 1.4.x is formally incompatible with IDF 5.5
(esp-hosted-mcu#47) and the factory C6 slave firmware was ancient
(couldn't even answer a version RPC). Waveshare's examples pin 1.4.* —
do not follow them.

Fix:
- host: espressif/esp_hosted ^2.12 (+ esp_wifi_remote 1.6)
- slave: 2.12.11 network_adapter.bin embedded in the app (c6_ota.c
  streams it to the C6 over the SDIO RPC channel at boot when the
  reported version is < 2.x; ~10s, no wires, idempotent)
- RAM diet for hosted 2.x's footprint (MEMPOOL_PREFER_SPIRAM,
  reduced WIFI_RMT buffers) — without it internal SRAM famine
  boot-loops in xTaskCreateStaticPinnedToCore before app_main
- conservative 20MHz SDIO clock for first verified data path

Verified on hardware: DHCP lease (even that healed), 8/8 pings to
router and tower-of-joy at 1-5ms, WebSocket to the gateway connected,
device registered at /devices as desklock-p4 with fw version.

Also: wifi_diag.c L1 SoftAP diagnostic mode (DESKLOCK-DIAG) with
review fixes, boot ping ladder in net.c, static-IP fallback,
face_status() line, docs for the whole failure taxonomy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -33,6 +33,10 @@ make lint typecheck
 - **PSRAM 200 MHz requires `CONFIG_IDF_EXPERIMENTAL_FEATURES=y`** — without it the
   option silently degrades to 20 MHz and the DSI display underruns into a watchdog
   loop. Details in AGENTS.md.
+- **Wi-Fi = esp_hosted 2.x on BOTH chips** (host manifest + C6 slave, auto-OTA'd from
+  `main/c6_slave.bin`). 1.x on IDF 5.5 gives working control RPC but a dead data path
+  (the great July 14th debugging night). Boot-loop assert on
+  `xTaskCreateStaticPinnedToCore` = internal-RAM famine. Details in AGENTS.md.
 - Gateway speech deps are optional extras; `make setup` alone runs the app and tests
   without GPU/ML packages. `make setup` uses `python3.12` (system python3 is 3.8).
 - Tatlock replies open with a `<think>` block — always strip via