feat(firmware): v0.6.7-esp32 — real LP-core program + C6 soft-AP HE/TWT helper

ADR-110 P9 — software-only unblocks for the WITNESS-LOG-110 §B
hardware-blocked items. Two new modules, both default-off so v0.6.6 fleets
see no behavior change.

LP-core (B4 path):
- New firmware/esp32-csi-node/main/lp_core/main.c: real RISC-V LP-core
  motion-gate program with debounce + monotonic motion_count counter.
- c6_lp_core.c rewritten to load + run the LP binary via ulp_lp_core_run
  when CONFIG_C6_LP_CORE_ENABLE=y; falls back to the v0.6.6 ext1 GPIO-wake
  path otherwise (keeps regression surface small).
- ulp_embed_binary() wired in main/CMakeLists.txt, gated on the Kconfig.
- New Kconfig knobs: C6_LP_POLL_PERIOD_US (default 10 ms),
  C6_LP_DEBOUNCE_SAMPLES (default 3).
- Exposes c6_lp_core_motion_count() / c6_lp_core_poll_count() for the
  witness harness — once an INA/Joulescope is on the bench, B4 is one
  capture away from a measured number.

Soft-AP HE (B1/B2 unblock):
- New c6_softap_he.{h,c}: brings up the C6 in AP+STA mode with WPA2-PSK
  + HE advertisement, so a second C6 in STA mode can negotiate real
  iTWT against a known-cooperative AP without buying an 11ax router.
- main.c calls c6_softap_he_start() right before esp_wifi_start() when
  CONFIG_C6_SOFTAP_HE_ENABLE=y.
- New Kconfig knobs: C6_SOFTAP_HE_{SSID,PSK,CHANNEL} with NVS overrides
  via softap_ssid / softap_psk / softap_chan in the ruview namespace.

Build artifacts (IDF v5.4, both green, RC=0):
- S3 8 MB: 1093 KB (47% partition slack)
- C6 4 MB: 1019 KB (45% partition slack)
- SHA-256 sums in dist/firmware-v0.6.7/SHA256SUMS.txt

Doc updates: CHANGELOG wave-3 entry, ADR-110 phase table gets P5
upgrade note + new P9 row, WITNESS-LOG-110 gets new A0 section
recording the v0.6.7 build evidence.

Co-Authored-By: claude-flow <ruv@ruv.net>

firmware/esp32-csi-node/main/CMakeLists.txt

@@ -15,6 +15,8 @@ set(SRCS
     "c6_lp_core.c"
     # ADR-110 D1 workaround — ESP-NOW cross-node sync (works on S3+C6)
     "c6_sync_espnow.c"
+    # ADR-110 B1/B2 unblock — soft-AP HE/TWT (C6-only when enabled)
+    "c6_softap_he.c"
 )
 
 # ESP-IDF v6+: headers must resolve via explicit REQUIRES (no implicit deps).
@@ -65,3 +67,15 @@ idf_component_register(
     INCLUDE_DIRS "."
     REQUIRES ${REQUIRES}
 )
+
+# ADR-110 P5 (full): embed the LP-core motion-gate program when enabled.
+# `ulp_embed_binary` compiles lp_core/main.c with the RISC-V LP toolchain
+# and links the resulting binary into the HP image, exposing shared symbols
+# via the auto-generated `ulp_main.h` header.
+if(IDF_TARGET STREQUAL "esp32c6" AND CONFIG_C6_LP_CORE_ENABLE)
+    set(ulp_app_name ulp_main)
+    set(ulp_sources "lp_core/main.c")
+    # Source files in the HP component that include the generated ulp_main.h
+    set(ulp_exp_dep_srcs "c6_lp_core.c")
+    ulp_embed_binary(${ulp_app_name} "${ulp_sources}" "${ulp_exp_dep_srcs}")
+endif()