refactor(radio): chart-first restructure on hsmc 0.3 + soak hardening

Migrate from hsmc 0.2 (local-patched) to hsmc 0.3.0 (crates.io, with
embassy + trace-defmt features). Restructure radio chart and bundle
several adjacent stability changes that need to land together for
soak runs.

Radio chart:
- Booting (default, no handlers) -> Operational (default Unconfigured;
  super-state owning CmdPing/CmdGetInfo/Reset/WedgeDetected handlers
  + Recovering + CheckRecoveryBudget) -> Dead (terminal).
- Cold init's during is structurally un-cancellable.
- radio_task is a 30-line shim that panics if run() returns (chart is
  non-terminating).
- Internal queue capacity bumped 8 -> 32 to cover action-emit bursts.

Host chart:
- Connected splits into WaitingForFirstFrame (default, no timer) +
  Active (chart-owned 1s inactivity timer via on(after) + self-
  transition on FrameReceived). Manual Timer::after + last_frame_at
  removed.

Soak hardening:
- ld/nrf52840-memory.x: app start 0x1000 -> 0x26000 to leave the
  factory s140 SoftDevice dormant in flash.
- hal/nrf52840.rs: dump POWER.RESETREAS on boot -- WARN on DOG/LOCKUP,
  INFO on RESETPIN/SREQ/wake-from-OFF.
- host/usb.rs: read_packet errors discriminated -- Disabled is debug
  (normal during USB enum), BufferOverflow stays warn.
- COBS encode warns now carry type/tag/payload-length for diagnosis.
- RADIO_THROTTLED static initializes to true (no proof of host drain
  at boot).
- driver/sh1106.rs: init retries 3x with 100ms backoff (intermittent
  first-write race on power-up).
- Cargo.toml: unexpected_cfgs allowlist for hsmc's journal/trace-*
  features.

docs/semtech_lora_cad_lbt_guidebook.md: vendor the Semtech CAD/LBT
reference for offline lookup.

ld/nrf52840-memory.x

@@ -1,16 +1,21 @@
-/* nRF52840 memory layout — Adafruit UF2 bootloader
+/* nRF52840 memory layout — Adafruit UF2 bootloader + s140 SoftDevice
  *
  *   0x00000 – 0x01000   MBR (Master Boot Record)
- *   0x01000 – 0xEA000   Application  ← we live here
+ *   0x01000 – 0x26000   s140 SoftDevice (dormant — we don't use BLE)
+ *   0x26000 – 0xEA000   Application  ← we live here
  *   0xEA000 – 0xF4000   Reserved (app data)
  *   0xF4000 – 0xFC000   UF2 Bootloader
  *   0xFF000 – 0x100000  Bootloader settings
  *
- * RAM: first 8 bytes reserved for MBR interrupt forwarding.
+ * RAM: first 8 bytes reserved for MBR interrupt forwarding. SoftDevice
+ * RAM (typically 0x20000008–0x20002000) is NOT reserved here because we
+ * never call sd_softdevice_enable — SD sits dormant in flash and never
+ * touches RAM. cortex-m-rt's set-vtor feature handles relocating VTOR
+ * to the app's vector table at 0x26000 at runtime.
  */
 
 MEMORY
 {
-  FLASH : ORIGIN = 0x00001000, LENGTH = 0xE9000
+  FLASH : ORIGIN = 0x00026000, LENGTH = 0xCE000
   RAM   : ORIGIN = 0x20000008, LENGTH = 255K
 }