ADR-110: ESP32-C6 firmware extension (#764)

Closes the firmware-side ADR-110 design at v0.7.0-esp32 after a 38-iter /loop SOTA sprint.

Headline (bench, COM9+COM12 ESP32-C6):
- 99.56% cross-board RX, 104.1 µs smoothed offset stdev (≤100 µs §2.4 target met)
- 3.95× EMA suppression, 1.4 ppm crystal skew preserved

4 firmware releases: v0.6.7 / v0.6.8 / v0.6.9 / v0.7.0-esp32.
42 ADR-110 unit tests, 1761 v2 workspace tests, full Firmware CI + QEMU green.

firmware/esp32-csi-node/test/stubs/esp_stubs.c

@@ -73,3 +73,13 @@ static mmwave_state_t s_stub_mmwave = {0};
 esp_err_t mmwave_sensor_init(int tx, int rx) { (void)tx; (void)rx; return ESP_ERR_NOT_FOUND; }
 bool mmwave_sensor_get_state(mmwave_state_t *s) { if (s) *s = s_stub_mmwave; return false; }
 const char *mmwave_type_name(mmwave_type_t t) { (void)t; return "None"; }
+
+/* ADR-110 iter 38 — fuzz-harness stub for c6_sync_espnow_is_valid.
+ * Real implementation lives in main/c6_sync_espnow.c; the fuzz target
+ * (`fuzz_serialize`) only links csi_collector.c against esp_stubs.c, so
+ * iter-11's `if (c6_sync_espnow_is_valid()) flags |= (1 << 4);` needs a
+ * symbol here or `clang -fsanitize=fuzzer` fails with an undefined-reference
+ * linker error. Returning false means the bit-4 cross-node-sync-valid flag
+ * stays 0 in fuzz inputs, which is the natural fuzz semantic. */
+#include <stdbool.h>
+bool c6_sync_espnow_is_valid(void) { return false; }